sFlow vs netFlow/IPFIX

Sun Feb 28 23:15:55 UTC 2016

What HW are your looking at our are you rolling your own probes?  Router/switch HW almost never does both.   Netflow/IPFIX puts the flow intelligence in the router, but with that comes more limitations.

 Sflow typically uses more BW because you are sending headers for each packet.  The sflow collector also needs more intelligence since it's doing flow correlation, AS matching, etc. instead of the router doing it.  However it is more flexible since adding a new header, like vxlan or NSH is much easier to implement in some analysis SW than router SW.  

Phil

From: Todd Crane
Sent: Sunday, February 28, 2016 3:09 PM
To: nanog at nanog.org
Subject: sFlow vs netFlow/IPFIX

This maybe outside the scope of this list but I was wondering if anybody had advice or lessons learned on the whole sFlow vs netFlow debate. We are looking at using it for billing and influencing our sdn flows. It seems like everything I have found is biased (articles by companies who have commercial offerings for the "better" protocol)

Todd Crane