Real world sflow vs netflow?

Sat Jul 14 17:15:58 UTC 2012

On 7/14/12 11:15 AM, Mikael Abrahamsson wrote:
> On Sat, 14 Jul 2012, Łukasz Bromirski wrote:
>
>> NetFlow, jFlow, IPFIX deal with flows. You can discuss sampling
>> accuracy and things like that, but working with flows is more accurate.
>
> If you do 1:1000 sampling with both Netflow and sFlow, why would one of
> them be more accurate than the other? If you analyze the flow on the
> device or on the collector (as might be done with sFlow), I don't see
> why one would be btter than the other.

Sure, but with sampling you'll loose accuracy anyway. The difference is
subtle, and depends on the (Net|j)Flow implementation - on some devices
for sampled NetFlow you'll still get sampled FLOWS (1:x) not sampled
PACKETS (thus disregarding the flow advantage).

-- 
"There's no sense in being precise when |               Łukasz Bromirski
  you don't know what you're talking     |      jid:lbromirski at jabber.org
  about."               John von Neumann |    http://lukasz.bromirski.net