How Netflow sampler works for C9500

[Difan_Zhao]

Hi team,

I want to know how exactly netflow sampler works for the Catalyst 9500 series. Does it look at one packet for every 10 packets (and the 10 packets could be for any flows), or does it still capture every flow, but only sample 1 packet out of 10 in the same flow? I think my question is, will sampler lose flows, or will it just lose the stats (like total bytes or packets) of a flow when all flows are still being recorded?

Thanks!

Difan

[Difan_Zhao]

Thanks Gemma, but will it lose flows or not? I understand that it makes the switch's life easier but I want to know what I will lose... Thanks.

[GemmaGage]

You can lose flows. The sampler operates at the packet level, meaning it randomly picks every Nth packet (1 out of 10). If a flow has very few packets and none of them get sampled, that flow won’t be recorded at all. (imo)

So, while netflow will still track sampled flows properly, some low volume flows might not appear in the records at all. What you mainly lose is accuracy in total byte/packet counts, and potentially entire flows if they don’t have sampled packets.

If flow completeness is critical, reducing the sampling rate (1 out of 2 instead of 1 out of 10) helps capture more flows at the cost of some overhead.

[GemmaGage]

Thanks for marking my answer as solution!!