[156695] in North American Network Operators' Group
Re: Real world sflow vs netflow?
daemon@ATHENA.MIT.EDU (Dobbins, Roland)
Sun Sep 23 15:18:16 2012
From: "Dobbins, Roland" <rdobbins@arbor.net>
To: NANOG list <nanog@nanog.org>
Date: Sun, 23 Sep 2012 19:17:42 +0000
In-Reply-To: <CAB8g2zxVzzjs7ikw2RgAzXzqNKt193N7K4aNEfa8Xg8c+q64_Q@mail.gmail.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Sep 23, 2012, at 11:23 PM, Peter Phaal wrote:
> The difference between packet oriented or flow oriented export is an "imp=
lementation detail" if your only requirement is to obtain layer IP flow rec=
ords, but becomes significant if you want to create customized flow records=
or create packet oriented metrics. Applications for packet oriented metric=
s mentioned earlier in this thread included route analytics, analysis of EC=
MP/LAG/TRILL forwarding, packet size distribution vs. DSCP, DDoS mitigation=
.
It might be a good idea to read up on Flexible NetFlow, IPFIX, and PSAMP ov=
er IPFIX, since everything you mention above can be done by collecting/anal=
yzing those telemetry formats.=20
In fact, it might be a good idea to read up on plain old classical NetFlow =
v5 and v9, too, as almost all of what's mentioned above is accomplished eve=
ry day using them, as well, heh.
> The problem with having the router perform the flow analysis is that once=
data is aggregated, it can't be disaggregated.
Nobody in this thread has advocated aggregated NetFlow. I certainly don't.=
=20
At any rate, I knew this would happen if we started talking about the merit=
s of s/Flow vs. NetFlow. For some reason, s/Flow advocates seem to feel co=
mpelled to come up with straw-man arguments and misstatements, and try to u=
se them to 'prove' what they view as the inherent superiority of s/Flow - w=
hen any unbiased indvidual who's worked with both formats at length knows t=
hat this simply isn't true.
In this particular instance, I guess it's natural to feel compelled to pres=
ent one's own creations in a positive light. However, it just isn't cricke=
t to make incorrect, incomplete, and/or misleading statements about perceiv=
ed competitors to one's own creations, you know?=20
> It's like the difference between receiving eggs or an omelette. If you li=
ke the omelette, great! But if you wan't a different omelette or would like
> to poach, boil, scramble or bake your eggs then getting the raw eggs is a=
lot more versatile.
At any rate, I've wasted enough of everyone's time/bandwidth as a result of=
this particular instance of flow telemetry format trolling; I won't be pro=
viding anything more in the way of sustenance.
;>
-----------------------------------------------------------------------
Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com>
Luck is the residue of opportunity and design.
-- John Milton
