[c-nsp] Netflow/Sflow for "irrelevant" traffic?

[Drew Weaver]

So if a flow is less than the sampling rate it does not export anything, I believe is what you are saying.

Thanks,
-Drew


-----Original Message-----
From: Saku Ytti <saku at ytti.fi> 
Sent: Thursday, July 30, 2020 8:36 AM
To: Drew Weaver <drew.weaver at thenap.com>
Cc: Dobbins, Roland <Roland.Dobbins at netscout.com>; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Netflow/Sflow for "irrelevant" traffic?

On Thu, 30 Jul 2020 at 15:26, Drew Weaver <drew.weaver at thenap.com> wrote:

> So just for a refresher if you are sampling lets say at 1:500 and lets say 1 byte goes through an interface that is not intended to produce an export?
> The exporting only happens if the amount of data is over a certain threshold? Does that threshold vary?

You'd pick up every nTh packet for sampling.

sample(packet) if packet_count % 500 == 0

-- 
  ++ytti