Posted on October 10, 2017 6:13 pm
 |  Asked by ipaccess ipaccess
Print Friendly, PDF & Email

Hi everyone,

We looks to increase the sFlow sampling rate to 100 (1 sample per 100 packets). The document states that it is possible with “dangerous” option but it doesn’t state the impact on CPU and the switch performance.

Is there anyone who has the same deployment? Can you advise or point to the document that explains the impact of such change in the configuration?


Answered on October 22, 2017 5:27 am


The CPU utilization with the suggested sampling rate can’t be quantified since it depends on other processes the CPU is currently running.

That said, below are the points that need to be noted when operating sFflow mode dangerous:

1. The switch uses either Control Plane Policing or Port-based Denial-of-service Protection to protect the kernel from being overwhelmed. 

This is basically rate limiting the traffic that goes towards the kernel from the hardware. 

This will make sure, that the CPU gets only as much traffic that it can handle. 

This also means you might not get every packet you would expect in the kernel since some of this traffic might be dropped. 

2. You might start noticing congestion drops towards the CPU if the sampling interval is very low (aggressive), because, the hardware would not be able to send all the traffic to the kernel due to rate limiting. 

3. The CPU utilization will increase (though not quantified, the CPU should be able to handle that), when you have an aggressive sampling rate. 

Please feel free to reach out to Arista TAC if you observe any issues in this.

Post your Answer

You must be logged in to post an answer.