sFlow vs netFlow/IPFIX
rdobbins at arbor.net
Mon Feb 29 10:14:23 UTC 2016
On 29 Feb 2016, at 16:59, Pavel Odintsov wrote:
> I have only one question. Why you against sFLOW protocol telemetry
> with so huge passion ? :)
Because I've had very poor experiences with it. And it doesn't seem to
scale very well.
> Actually, sflow is not so popular as netflow. But to be honest it's
> pretty young standard in compare with netflow and it implements
> slightly different approach.
sFlow has been around for a while, though. It isn't new.
> So IX could not use netflow even if they want.
This depends upon the devices utilized - there are actually some devices
which can export layer-2 NetFlow.
There are other issues with NetFlow as it's currently generally
implemented which are also concerns with IX scenarios, FYI. I will
leave it as an exercise for you to find out what they are.
> But you vote for "sflow is weird protocol and you should avoid it".
My view is that it's generally better to use NetFlow or IPFIX, where and
> How IX could monitor traffic if they haven't netflow? So if they
> follow your recommendations they should drop idea about traffic
> monitoring at all :)
Straw man. I never said that nor implied it. If sFlow is all that's
available, then of course operators can and should use it.
> But actually in modern network world every technology has applicable
> usage and it's
> not good idea to avoid it just because your religion (I'm speaking
> about netflow religion) prohibit it for you.
It isn't 'religion'. It's based upon the fact that a) my experiences
with sFlow have been suboptimal and b) sFlow isn't generally available
on large routers used at network edges.
> Actually you are writing this email from company email and I could
> conclude it's Arbor vision and is not your own.
No, that is incorrect. I speak only for myself. And as I previously
noted, Arbor products support sFlow, and have for many years; I'm just
not a big fan of it.
> Could you clarify it?
I just did.
> Could I use your vision as Arbor's vision in public speeches /
No, you may not, per the above. Arbor is telemetry-neutral; we aim to
support all relevant telemetry formats in line with the expressed needs
of our customers. And that includes sFlow.
These trollish, passive-aggressive rhetorical tactics grow wearisome. I
will not reply any further to this thread, so as to avoid further
spamming the list.
Roland Dobbins <rdobbins at arbor.net>
More information about the NANOG