Packet sampling is used to characterize network traffic. If the sFlow agent is configured for packet sampling, the agent takes copies of random samples of packets forwarded within the switch CPU and sends them to the switch for processing.
The CPU sends a configured portion of the sampled packet, containing a number of protocol headers and possibly some of the payload data to the sFlow collector. Random sampling prevents the synchronization of periodic traffic patterns.
On the average, 1 in every N packets is captured and analyzed. The sampling can apply to ingress and egress frames independently. The rate that the agent sends datagrams depends on the sampling rate, the traffic rate, and the configured maximum datagram size.
Typically, several samples are included in the datagram.