[154955] in North American Network Operators' Group
Re: Real world sflow vs netflow?
daemon@ATHENA.MIT.EDU (Nick Hilliard)
Tue Jul 17 12:38:31 2012
X-Envelope-To: <nanog@nanog.org>
Date: Tue, 17 Jul 2012 17:37:44 +0100
From: Nick Hilliard <nick@foobar.org>
To: nanog@nanog.org
In-Reply-To: <aa8vei768y.fsf@switch.ch>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On 17/07/2012 16:32, Simon Leinen wrote:
> That's one reason, but another reason would be that at least in Netflow
> (but sFlow may be similar depending on how you use it), the reported
> byte counts only include the sizes of the "L3" packets, i.e. starting at
> the IP header, while the SNMP interface counters (ifInOctets etc.)
> include L2 overhead such as Ethernet frame headers and such.
sflow includes both figures.
Nick
