Security MAC ACLs can be used to permit and/or deny ethernet packets on the egress port by matching on the following

Packets sampled for sFlow are packaged in a flow sample structure containing, amongst other things, input and output

Packets sampled for sFlow are packaged in a flow sample structure containing, amongst other things, input and output

GRE (Generic Routing Encapsulation) packet header has a Key extension which is used by Arista to carry packet