Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Filter-Based sFlow Packet Sampling Overview

sFlow sampling with firewall filters extends traditional packet‑based sFlow by enabling selective ingress packet sampling based on firewall filter criteria in Junos OS Evolved.

Filter‑based sFlow packet sampling extends the traditional sFlow packet‑based sampling model by enabling selective packet sampling based on firewall filter criteria. This feature allows you to sample ingress traffic that matches specific firewall filter or user-defined filter (UDF) terms instead of sampling uniformly across an interface.

Standard sFlow provides efficient, statistical visibility into overall traffic patterns. Firewall filter–based sFlow enhances this capability by enabling packet sampling to be applied directly within ingress firewall filters, allowing targeted visibility for monitoring policy‑sensitive traffic, validating security rules, or analyzing specific traffic classes.

With filter-based packet sampling enabled, sampled packets are selected based on filter matches and forwarded to the CPU for processing using the same sFlow infrastructure as packet‑based sampling. The sampling rate is controlled by the sFlow ingress sample‑rate configuration, ensuring consistent sampling behavior across both inaterface‑based and filter‑based sampling mechanisms.

When you configure filter-based packet sampling, you must specify an ingress sFlow sample-rate under the set protocols sFlow hierarchy. The device applies that same ingress sample rate to both the interface-based and filter-based packet sampling.

Benefits of Filter Based sFlow Packet Sampling

  • Targeted traffic visibility. Enables sampling of specific traffic flows that match defined firewall filter conditions, improving insight into security, policy, or application‑specific traffic.

  • Efficient use of sampling resources. Reduces unnecessary sampling by limiting packet selection to relevant traffic, minimizing overhead compared to uniform packet‑based sampling.

  • Integrated sFlow operation. Reuses existing sFlow infrastructure, including the same CPU queues and packet processing paths as packet‑based sampling.

  • Consistent sampling behavior. Uses the configured sFlow ingress sample‑rate to control both packet‑based and filter‑based sampling, simplifying operational management.

  • Flexible filter support. Supports sampling on ingress firewall filters across multiple filter families, including regular filters and user‑defined filters (UDF).

Limitations

  • Filter‑based sFlow sampling is supported only on ingress firewall filters.
  • If an ingress sFlow sample‑rate is not configured, the filter sampling action has no operational effect.
  • Host‑bound traffic is not subject to firewall filter‑based sampling.
  • A packet that qualifies for both packet‑based and filter‑based sampling generates only one sample.
  • Sampled packets are subject to existing DDoS queue configuration.
  • On QFX5220 platforms, the sFlow sample‑rate is applied on a per‑interface basis.