I'm configuring a new IMC server and we have added a test traffic analysis task to collect sflow information for a tagged/trunk uplink on an access layer switch.
After adding the task and waiting a while we are seeing what appears to be accurate information. However, we are also seeing a lot of "Unconfigured interfaces" populate in the traffic analysis task section despite only configuring sflow for the trunk interface.
My guess is this is by design in that to collect accurate information about that trunk it wants to sample all interfaces to make sure no traffic is missed. Does this make sense? The only reason I suppose that I care about this is that we receive an email every time a new interface is learned about which gets annoying.
EDIT: Looking at this more it does seem that sFlow will report the source and destination interfaces for each packet it samples, so given our scenario of monitoring a trunk interface it makes sense it will end up sending datagrams that reference other interfaces. IMC's handling of it might be unique in that it populates the other interfaces, but the logic seems to make sense.
No comments:
Post a Comment