Real world sflow vs netflow?

Sat Sep 22 05:02:39 UTC 2012

On Sep 22, 2012, at 12:40 AM, Peter Phaal wrote:

>  However, moving the flow generation out of the router gives a lot of flexibility. 

Actually, moving it out of the router creates huge problems and destroys a lot of the value of the flow telemetry - it nullifies your ability to traceback where traffic is ingressing your network, which is key for both security as well as traffic engineering, peering analysis, etc.

It is far, far better to get your flow telemetry from your various edge routers, if at all possible, rather that probes.  Scales better, too - and is less expensive in terms of both capex and opex.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton