On Thursday, August 1, 2019 at 2:46:20 PM UTC-7, Francois Labonte wrote:
Determining the direction of a packet sample if you have bi-directional sampling enabled on a one armed router port is challenging, but it isn't a situation that commonly comes up. sFlow is typically enabled ingress only on all switches and all switch ports - a configuration strategy that reduces operational complexity, increases scalability, and ensures that all packet paths are observed.
However, if bidirectional sampling is enabled, an sFlow analyzer can determine direction, first by detecting that the packet has been looped (ingress_port == egress_port), and then by examining the MAC addresses from the sampled packet. If the destination MAC belongs to the device then the sample was taken on ingress, if the source MAC address belongs to the device then the sample was taken on egress.
The list of router MAC addresses is static information that can be gathered via SNMP or an API call to the device. It may also be possible to determine device MACs by examining TTL, MAC, and IP address information from routed packets, or by looking for traffic that terminates at the router (BGP, LLDP, STP, etc).