NetFlow - path from Routers to Collector

Tue Sep 1 17:55:47 UTC 2015

Looking at probably 100 networks' flow paths over the last year,
I'd say 1 or 2 have OOB for flow.

Maybe another 10-20 have interest in taking simpler time series
data of top talkers over their OOB networks, but not the flow
itself.

Agree w Roland that it can cause problems with telemetry if
there are big network misconfigs.  But for folks seeing DDoS,
we implement rate-limiting of the flows/sec via local proxies
to avoid overwhelming network capacity with the flow data...

Avi

>	I think the key here is that Roland isn't often constrained by
> these financial considerations.
> 
>	I would respectfully disagree with Roland here and agree with
> Job, Niels, etc.
> 
>	A few networks have robust out of band networks, but most
> I've seen have an interesting mixture of things and inband is usually
> the best method.
> 
>	Those that do have "seperate" networks may actually be CoC
> services from another deparment in the same company riding the same
> P/PE devices (sometimes routers).
> 
>	I've seen oob networks on DSL, datacenter wifi or cable swaps
> through the fence to an adjacent rack.
> 
>	An oob network need not be high bandwidth enough to do netflow
> sampling, this is well regarded as a waste of money by many as the costs
> for these can often be orders of magnitude more compared to a pure-IP
> or internet service.
> 
>	I'll say this ranks up there with people who think
> MPLS VPN == Encryption.  It's not unless you think a few byte
> label is going to confuse people.
> 
> 	- Jared