<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Hi André,</p>
<p id="reply-intro">On 2023-06-23 07:59, André Grüneberg wrote:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<div id="replybody1">
<div dir="ltr">
<div class="v1gmail_quote">
<div>This does not matter. All traffic coming from others to this one member is NOT being measured on the member's port but on others' ports.</div>
</div>
</div>
</div>
</blockquote>
<div id="replybody1">
<div dir="ltr">
<div class="v1gmail_quote">
<div> </div>
<div>Yes, but in the case of the member who is reporting only ~50% stats at our side, they are only comparing a few peers, which do not involve subinterfaces.</div>
<div> </div>
<div> </div>
<div> </div>
</div>
</div>
</div>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<div id="replybody1">
<div dir="ltr">
<div class="v1gmail_quote">
<div>Presuming that you have sFlow enabled only on edge ports and your're generating sFlow for inbound traffic flow (the usual setting for Arista).</div>
</div>
</div>
</div>
</blockquote>
<div id="replybody1">
<div dir="ltr">
<div class="v1gmail_quote">
<div> </div>
<div>Yep - we only have sflow enabled on member interfaces.</div>
<div> </div>
<div>In the case of LAGs, we have (irrelevant config snipped for simplicity):</div>
<div> </div>
<div>
<div><span>interface Ethernet17/3</span></div>
<div><span> no switchport</span></div>
<div><span> channel-group 108 mode active</span></div>
<div><span> no sflow enable</span></div>
<div> </div>
<div><span>interface Port-Channel108</span></div>
<div><span> switchport access vlan 4</span></div>
<div><span> switchport</span></div>
<div><span> mac access-group MAC-ACL-Port-Channel108 in</span></div>
<div><span> sflow enable</span></div>
</div>
<div> </div>
<div> </div>
<div>Going off on a tangent, but how does your subinterface configs look? - again, with non-important bits removed:</div>
<div> </div>
<div>interface Port-Channel105<br /> no switchport<br /> sflow enable</div>
<div> </div>
<div>interface Port-Channel105.4<br /> encapsulation dot1q vlan 4<br /> vlan id 4<br /> mac access-group MAC-ACL-Port-Channel105.4 in</div>
<div> </div>
<div>interface Port-Channel105.646<br /> encapsulation dot1q vlan 646<br /> vlan id 4<br /> mac access-group MAC-ACL-Port-Channel105.646 in</div>
<div> </div>
<div>So I currently have sflow enabled on the parent interface and not the subinterfaces. I'm currently questioning with Arista which is recommended here - disabled on the parent and enabled on the subinterfaces or enabled on the parent and disabled on the subinterfaces. What do you use?</div>
<div> </div>
<div> </div>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<div><span style="font-size: 14px; font-family: Roboto, sans-serif; background-color: #ffffff;">Yes, it's intoducing a mapping of the tuple (agent, interfaceid, vlanid) -> peering VLAN ID ... so the rest of the script can digest the flow as "peering traffic". :)</span></div>
</blockquote>
<div> </div>
<div><span style="font-size: 14px; font-family: Roboto, sans-serif; background-color: #ffffff;">Interested in the mechanism you are using here - have you built that in to the sflow-to-rrd-handler script or are you using an external script to periodically query the database and export these [into a file]. The latter is what I was planning to do.</span></div>
<div> </div>
<div> </div>
</div>
</div>
</div>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<div id="replybody1">
<div dir="ltr">
<div class="v1gmail_quote">
<div>Well, there are some "heavy" PVLANs that can easily account for ~50G at that time. And the remainder is within our acceptable error margin of 10%.</div>
</div>
</div>
</div>
</blockquote>
<div id="replybody1">
<div dir="ltr">
<div class="v1gmail_quote">
<div> </div>
<div>Ah, so you have not modified it to include PVLANs, you're only counting peering lan traffic in those overalls still?</div>
<div> </div>
<div> </div>
</div>
</div>
</div>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<div id="replybody1">
<div dir="ltr">
<div class="v1gmail_quote">
<div>Yes, mostly we are running smapling rate 16384 -- same as yours.</div>
</div>
</div>
</div>
</blockquote>
<div id="replybody1">
<div dir="ltr">
<div class="v1gmail_quote">
<div> </div>
<div>Mostly???</div>
<div> </div>
</div>
</div>
</div>
<div id="replybody1">
<div dir="ltr">
<div class="v1gmail_signature" dir="ltr">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<p>Thank you!</p>
<p>Ian</p>
<p><br /></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body></html>