21.1.4 sFlow statistical operation of the Switch

<Structure of this section>

(1) sFlow Statistics-Collected Ports

The Switch samples sFlow stats for all Ethernet interfaces except the management port and stack port (when stacked). In addition, you can select either reception (ingress) or transmission (egress) as the sampling attribute on a per-device basis.

(2) Target packet of the flow sample

The Switch sets packets forwarded by hardware as flow samples.

The following packets are not treated as flow samples for both reception and transmission:

Software forwarding packet
Spontaneous packet
Own packet

Depending on the sampling attribute, the following packets are not treated as sampling targets:

Packets that are not treated as sampling targets in the reception specification

Packets discarded by the Ethernet interface

Packets that are not treated as sampling targets in the transmission specification

Packets sent from port mirroring and policy-based mirroring mirror ports

(3) Discarded Packet Flow Sample Operation

Even if packets are discarded by the Switch, the flow sample of the Switch may send sFlow packets as if they were forwarded to collectors. Check and operate the conditions under which packets are discarded by other functions. The following table shows the flow sample operation for discarded packets by other functions.

Table 21-16: Example flow of discarded packets using other functions
Ability to discard	Receive order	Specify transmission
Ability to discard	Receive order	Switch with the same incoming and outgoing ports	Switches in a stacked configuration with different incoming and outgoing ports
Filter (receiver)	Be collected	Do not collect	Do not collect
QoS (bandwidth monitoring)	Be collected	Do not collect	Do not collect
Filter (sender)	Be collected	Be collected	Be collected
QoS (discard control)	Be collected	Be collected	Be collected
Policy-based Routing	Be collected	Do not collect	Do not collect
Storm Control	Do not collect	Do not collect	Do not collect
Inter-port relay blocking	Be collected	Do not collect	Do not collect
Layer 2 function*1	Be collected	Do not collect	Do not collect
Layer 3 function*2	Be collected	Do not collect	Do not collect

Note #1

The following types of discard frames are used by Layer 2: If Untagged packets are received on a trunk port that does not have a native VLAN, VLAN ID of switch-type data received is 4095.

.Discarded by MAC address-learning function

.Discarded because it cannot be relayed by VLAN

.Discarded in Layer 2 Blocking

.Disposal by Layer 2 authentication

.Disposal by IGMP snooping,MLD snooping,DHCP snooping

.Discard When Layer 2 Protocol Is Disabled

Note #2

Layer 3 discarded packets are listed below.

.Discarding Error Packets by IP Layer

.Disposal by routing protocol

(4) Notes on the sampling position of the flow sample contents

As a general rule, the flow sample of the Switch collects the contents of sFlow packets when they arrive at the Switch, regardless of whether they are sampled in the receive mode or transmit mode. (The contents of packets are not reflected in sFlow packets even if they are converted in the Switch.)

The same applies when a packet discarded by the Switch is subject to flow sample processing. However, if packets that are forwarded (sent from a port on a switch that is different from the receiving port) are sampled in a stacked configuration across multiple member switches, the contents of the packets sent from the Switch may be collected depending on the forwarding conditions and other functions used. The following table describes the flow sampling by relay pattern.

Table 21-17: Contents of flow sampling by relay patterns
Sampling attribute	Stand-alone configuration	Stack configuration
Sampling attribute	Stand-alone configuration	Packets forwarded in the same switch	Packets forwarded across multiple member switches
Receive order	Contents of reception	Contents of reception	Contents of reception
Specify transmission	Contents of reception	Contents of reception	Contents at the time of reception or transmission

(5) Notes on flow sample contents when using other functions together

The flow sample information collected by the Switch varies depending on the functionality used by the sampling target port and the forwarding conditions for sampling packets. The following table shows the flow sample collection contents when the other functions are used and the relay conditions are used.

Table 21-18: Contents of flow sample collection when other functions are used and when forwarding conditions are used
Combination function and relay condition	Receive order	Specify transmission
Combination function and relay condition	Receive order	Switch with the same incoming and outgoing ports	Switches in a stacked configuration with different incoming and outgoing ports
VLAN tunneling (tunneling port reception)	Information before adding Tag for tunneling		Information after adding Tag for tunneling*1
VLAN tunneling (tunneling port transmission)	Information before deleting Tag for tunneling*2
VLAN Tag transformation (Tag Translation Port Receive)	Original Tag data		Converted Tag info*3
QoS markers (DSCP rewrite)	DSCP value before rewriting*4		DSCP after rewriting*4
QoS markers (User priority rewrite)	User priority before rewriting*5		User priority after rewriting*5
Layer 3 unicast forwarding	Information on reception		Information during transmission*6
Policy-based Routing	Information when receiving*7		Information during transmission*6

Note #1

When collecting switch-type information, Tag for tunneling is collected as source VLAN information. If Tag for tunneling is added and VLAN Tag is two or more stages, IPv4 type, IPv6 type, user type, and URL type are not collected.

Note #2

If VLAN Tag is two or more stages, IPv4 type, IPv6 type, user type, and URL type are not collected.

Note #3

When switch-type information is collected, Tag after Tag conversion is collected as source VLAN information.

Note #4

Header-type frame information, IPv4 type TOS information, and IPv6 type priority information.

Note #5

Header-type frame information and switch-type received packet VLAN information.

Note #6

Header type and switch type information are collected during transmission. No information is collected for the router type or gateway type.

Note #7

The following information is the routing information of the forwarding destination according to the routing protocol, instead of the routing information of the forwarding destination based on the policy base routing.

nexthop and dst_mask of router type formats

dst_peer_as and dst_as of gateway type formats

(6) Packets subject to counter sample collection

The counter sample on the Switch counts all packets sent and received on the port regardless of whether they are sent or received.