Real world sflow vs netflow?

Dobbins, Roland rdobbins at arbor.net
Sun Sep 23 15:16:26 UTC 2012


On Sep 23, 2012, at 7:55 PM, Danny McPherson wrote:

> If the *flow generation process is not performed on the router (or otherwise conveyed by some metadata outside of "raw [sampled] packet headers") then you lose visibility to ingress and egress ifIndex (interface) information -- information which is required if/when deploying controls on those systems to squelch various traffic flows. 

Thanks, Danny - I guess I should've spelled it out, thanks for clarifying, heh.

It should also be noted that generating the flows directly from the data plane of the router/switch or doing it offboard (as long as sufficient ingress/egress ifindex metadata are collected and exported, as you note) is just an implementation detail - it isn't inherent to s/Flow, NetFlow, IPFIX, et. al.  So, claiming this as some kind of advantage for a particular flow telemetry format is a non sequitur.

;>

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton




More information about the NANOG mailing list