[154855] in North American Network Operators' Group
Re: Real world sflow vs netflow?
daemon@ATHENA.MIT.EDU (=?ISO-8859-2?Q?=A3ukasz_Bromirski?)
Sat Jul 14 13:17:57 2012
Date: Sat, 14 Jul 2012 19:15:58 +0200
From: =?ISO-8859-2?Q?=A3ukasz_Bromirski?= <lukasz@bromirski.net>
To: nanog@nanog.org
In-Reply-To: <alpine.DEB.2.00.1207141113441.27169@uplift.swm.pp.se>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On 7/14/12 11:15 AM, Mikael Abrahamsson wrote:
> On Sat, 14 Jul 2012, Łukasz Bromirski wrote:
>
>> NetFlow, jFlow, IPFIX deal with flows. You can discuss sampling
>> accuracy and things like that, but working with flows is more accurate.
>
> If you do 1:1000 sampling with both Netflow and sFlow, why would one of
> them be more accurate than the other? If you analyze the flow on the
> device or on the collector (as might be done with sFlow), I don't see
> why one would be btter than the other.
Sure, but with sampling you'll loose accuracy anyway. The difference is
subtle, and depends on the (Net|j)Flow implementation - on some devices
for sampled NetFlow you'll still get sampled FLOWS (1:x) not sampled
PACKETS (thus disregarding the flow advantage).
--
"There's no sense in being precise when | Łukasz Bromirski
you don't know what you're talking | jid:lbromirski@jabber.org
about." John von Neumann | http://lukasz.bromirski.net
