Real world sflow vs netflow?

Dobbins, Roland rdobbins at
Sun Sep 23 15:16:26 UTC 2012

On Sep 23, 2012, at 7:55 PM, Danny McPherson wrote:

> If the *flow generation process is not performed on the router (or otherwise conveyed by some metadata outside of "raw [sampled] packet headers") then you lose visibility to ingress and egress ifIndex (interface) information -- information which is required if/when deploying controls on those systems to squelch various traffic flows. 

Thanks, Danny - I guess I should've spelled it out, thanks for clarifying, heh.

It should also be noted that generating the flows directly from the data plane of the router/switch or doing it offboard (as long as sufficient ingress/egress ifindex metadata are collected and exported, as you note) is just an implementation detail - it isn't inherent to s/Flow, NetFlow, IPFIX, et. al.  So, claiming this as some kind of advantage for a particular flow telemetry format is a non sequitur.


Roland Dobbins <rdobbins at> // <>

	  Luck is the residue of opportunity and design.

		       -- John Milton

More information about the NANOG mailing list