[156596] in North American Network Operators' Group
Re: Real world sflow vs netflow?
daemon@ATHENA.MIT.EDU (Peter Phaal)
Thu Sep 20 12:59:53 2012
In-Reply-To: <50012E21.4060802@bromirski.net>
Date: Thu, 20 Sep 2012 09:59:24 -0700
From: Peter Phaal <peter.phaal@gmail.com>
To: =?ISO-8859-2?Q?=A3ukasz_Bromirski?= <lukasz@bromirski.net>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Sat, Jul 14, 2012 at 1:30 AM, =C5=81ukasz Bromirski <lukasz@bromirski.ne=
t> wrote:
> sFlow is really sPacket, as it doesn't deal with flows.
>
> NetFlow, jFlow, IPFIX deal with flows.
I am a puzzled by the orthodoxy that seems to prevail around the value
"flows" as a measure of network traffic in packet switched networks.
The following article contains some thoughts on flow oriented and
packet oriented measurements. Apologies to NANOG readers for the
simplistic analogies used to describe packet switching, the article is
also intended for server administrators and application developers who
often don't really know what happens when they write some bytes to a
TCP socket.
http://blog.sflow.com/2012/09/packets-and-flows.html
The article positions flows as a useful abstraction for characterizing
host and application performance, but as a poor fit for understanding
packet traffic and measuring the performance of packet switches and
routers. This isn't really an issue of sFlow vs. NetFlow/IPFIX etc.
Either protocol can be used to export both types of measurements; the
question is what types of measurement should be exported.
What do people think?
Peter
