sflow with outinterface indiex as zero

[iyyappa Reddy]

Hi Team,

Customer reportd that sflow packets are reported with indexid=0 for egress interface by SLX to the collector for MPLS.

Regards,

Iyyappa.

[Peter Phaal]

The sFlow Version 5 spec, https://sflow.org/sflow_version_5.txt, page 27 states that that an output interface value of zero means that the agent is unable to determine the port (i.e. value is unknown).

[iyyappa Reddy]

Thanks for response.  Do you think that below could be reason..

If the sample is taken before the “egress port resolve” stage, the ASIC can egress ifindex as 0. I think it’s depending on ASIC pipeline stage where sampling occurred

Another question.

Q) when total traffic crossing the external interfaces hits about 10-11Gbps, the flows are probably getting dropped and incorrect stats are sent to the collector. This was happening with the sampling rate of 2048 pkts and after changing the rate to 16384 the problem has disappeared. Is there a peak rate of packets that sflow agent can handle  at various sampling rates? 

[Peter Phaal]

The explanation sounds reasonable. If the egress port hasn't been selected at the time the sample is reported by the ASIC then the port would be unknown.

The sFlow agent typically has a limit in samples per second that can be be processed by the CPU. This limit should be enforced by a hardware policer to protect that management CPU from excessive load. The sFlow limit should be listed in the device CoPP (control plane policer) settings for your device. 

Recommended sampling rates, https://sflow-rt.com/agents.php, provide responsive measurements while avoiding rate limits on samples that lead to systematic errors in the measurements. You may find the sFlow Test application useful in validating the accuracy of your sFlow agent, https://blog.sflow.com/2015/11/sflow-test.html. Interface counter and packet sample data are compared to verify accuracy.

[iyyappa Reddy]

Thanks for update. We will investigate further and get back.