[187934] in North American Network Operators' Group
Re: sFlow vs netFlow/IPFIX
daemon@ATHENA.MIT.EDU (Saku Ytti)
Mon Feb 29 07:03:06 2016
X-Original-To: nanog@nanog.org
In-Reply-To: <FFBBB0C1-7002-4B0C-84B6-429D81EFCB71@arbor.net>
Date: Mon, 29 Feb 2016 14:03:02 +0200
From: Saku Ytti <saku@ytti.fi>
To: Roland Dobbins <rdobbins@arbor.net>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
On 29 February 2016 at 04:24, Roland Dobbins <rdobbins@arbor.net> wrote:
>> Around here they are currently voting on a law that will require unsampled
>> 1:1 netflow on all data in an ISP network with more than 100 users.
>
> That's interesting, given that most larger routers don't support 1:1.
I find that strange, because if you're doing in in HW, doing hash
lookup for flow and adding packets and bytes to the counter is cheap.
It's expensive having lot of those flows, but incrementing their
packet and byte counter isn't.
I know that all JNPR Trio kit (MX, T, EX9k...) do 1:1. I guess if
you're doing it in LC CPU things are very different.
--
++ytti
