[187914] in North American Network Operators' Group
RE: sFlow vs netFlow/IPFIX
daemon@ATHENA.MIT.EDU (Phil Bedard)
Sun Feb 28 18:16:05 2016
X-Original-To: nanog@nanog.org
To: Todd Crane <todd.crane@n5tech.com>, "nanog@nanog.org" <nanog@nanog.org>
From: Phil Bedard <bedard.phil@gmail.com>
Date: Sun, 28 Feb 2016 18:15:55 -0500
In-Reply-To: <CE7FE2C2-80F9-4B42-83BB-7D4219C117D8@n5tech.com>
Errors-To: nanog-bounces@nanog.org
What HW are your looking at our are you rolling your own probes? Router/sw=
itch HW almost never does both. Netflow/IPFIX puts the flow intelligence =
in the router, but with that comes more limitations.
Sflow typically uses more BW because you are sending headers for each pack=
et. The sflow collector also needs more intelligence since it's doing flow=
correlation, AS matching, etc. instead of the router doing it. However it=
is more flexible since adding a new header, like vxlan or NSH is much easi=
er to implement in some analysis SW than router SW. =20
Phil
From: Todd Crane
Sent: Sunday, February 28, 2016 3:09 PM
To: nanog@nanog.org
Subject: sFlow vs netFlow/IPFIX
This maybe outside the scope of this list but I was wondering if anybody ha=
d advice or lessons learned on the whole sFlow vs netFlow debate. We are lo=
oking at using it for billing and influencing our sdn flows. It seems like =
everything I have found is biased (articles by companies who have commercia=
l offerings for the "better" protocol)
Todd Crane
