Real world sflow vs netflow?

Dobbins, Roland rdobbins at arbor.net
Sat Sep 22 05:02:39 UTC 2012


On Sep 22, 2012, at 12:40 AM, Peter Phaal wrote:

>  However, moving the flow generation out of the router gives a lot of flexibility. 

Actually, moving it out of the router creates huge problems and destroys a lot of the value of the flow telemetry - it nullifies your ability to traceback where traffic is ingressing your network, which is key for both security as well as traffic engineering, peering analysis, etc.

It is far, far better to get your flow telemetry from your various edge routers, if at all possible, rather that probes.  Scales better, too - and is less expensive in terms of both capex and opex.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton




More information about the NANOG mailing list