Real world sflow vs netflow?

Thu Sep 20 16:59:24 UTC 2012

On Sat, Jul 14, 2012 at 1:30 AM, Łukasz Bromirski <lukasz at bromirski.net> wrote:
> sFlow is really sPacket, as it doesn't deal with flows.
>
> NetFlow, jFlow, IPFIX deal with flows.

I am a puzzled by the orthodoxy that seems to prevail around the value
"flows" as a measure of network traffic in packet switched networks.

The following article contains some thoughts on flow oriented and
packet oriented measurements. Apologies to NANOG readers for the
simplistic analogies used to describe packet switching, the article is
also intended for server administrators and application developers who
often don't really know what happens when they write some bytes to a
TCP socket.

http://blog.sflow.com/2012/09/packets-and-flows.html

The article positions flows as a useful abstraction for characterizing
host and application performance, but as a poor fit for understanding
packet traffic and measuring the performance of packet switches and
routers. This isn't really an issue of sFlow vs. NetFlow/IPFIX etc.
Either protocol can be used to export both types of measurements; the
question is what types of measurement should be exported.

What do people think?

Peter