Packets are matched against filter entries to determine acceptability. With cflowd, only the first packet of a flow is compared. If the first packet matches the filter criteria, an entry is added to the cflowd cache. Subsequent packets in the same flow are also sampled based on the cache entry.
Because a filter can be applied to more than one interface (when configured with a scope template), the interface-disable-sample option is intended to enable or disable traffic sampling on an interface-by-interface basis. The command can be enabled or disabled as needed instead of having to create numerous filter versions.
To enable an interface for filter traffic sampling, the following requirements must be met:
Cflowd must be enabled globally.
At least one cflowd collector must be configured and enabled.
On the IP interface being used, the configure router interface cflowd-parameters sampling {unicast | multicast} type acl option must be selected.
On the IP filter being used, the entry>filter-sample option must be explicitly enabled for the entries matching the traffic that should be sampled. The default is no filter-sample. See Filter configurations for more information.
The filter must be applied to a service or a network interface. The service or port must be enabled and operational.