[tbortolossi]

Problem

The API dashboards show the total throughput from the MAC-level port counters since v1.4.5, but nothing shows how much of it is hardware-offloaded. During the PA-5580 load test the dataplane ibytes read ~47 Gb/s and the port counters ~97 Gb/s; the difference was the offloaded UDP.

Solution

• Collector: keep ibytes/obytes of each physical port as dp_in_octets/dp_out_octets, only when the matching port/rx-bytes/port/tx-bytes exist (no fake "0 offload" on platforms without the port block). Existing fields are unchanged.
• API and API Chassis dashboards: new Throughput Received: Dataplane vs Offloaded panel in the general section (full width, under the throughput / link-load row): Dataplane + Offloaded (estimate) stacked, Total as an unstacked line.
• Offloaded = port − dataplane, over windows of at least 2 minutes, taking the smaller of the current and previous window, floored at 5% of the total.

Why the smoothing

On the PA-440 (no offload hardware) the port counter is refreshed late and in bursts: 20 s differences swung by up to ±12 Mb/s, and 2-minute windows still read +11.6% and +27.6%. A late refresh reads negative then positive in consecutive windows, real offload stays positive, so min(current, previous) removes it. Trade-off: offload onset shows one window late.

Testing

• 283 unit tests pass; new tests for the collector fields (real 5580 XML shape) and the panel query.
• Live stack: Telegraf rebuilt, dp_* fields written for the 3 physical ports only; panel query through Grafana /api/ds/query returns Dataplane / Offloaded / Total, offloaded 0 on the PA-440.
• Synthetic Flux check: steady 97/47 → 49–50 offloaded; the PA-440 lag pattern → 0.

Not covered

• SNMP dashboards: no dataplane byte counter in the PAN MIBs, unchanged.
• Chassis (PA-7000/7500) not verified on hardware; if the port block is missing the panel shows no data.

Deploy

Rerun ./generate.sh to rebuild the Telegraf image.

🤖 Generated with Claude Code