Peter Phaal <peter.phaal@gmail.com> wrote on 07/13/2012 04:20:45 PM:
2. sFlow: Packets are randomly sampled in hardware and the packet headers are immediately exported as sFlow datagrams - there is no flow cache on the switch/router. In addition to exporting the packet header, the sFlow agent captures the FIB state associated with forwarding the sampled packet, exporting information such as next hop router, AS-path, communities etc
What about byte counts? Just those in the sampled packet (i.e., no running totals per flow)?
In contrast, the sFlow standard specifies how sampling must be performed and ensures that information is included that allows the sampled data to be correctly scaled and produce unbiased measurements.
Does sflow software typically recreate the total byte count per flow (e.g., TCP session) by scaling? Thanks, Joe