sFlow vs netFlow/IPFIX

Mon Feb 29 12:03:02 UTC 2016

On 29 February 2016 at 04:24, Roland Dobbins <rdobbins at arbor.net> wrote:
>> Around here they are currently voting on a law that will require unsampled
>> 1:1 netflow on all data in an ISP network with more than 100 users.
>
> That's interesting, given that most larger routers don't support 1:1.

I find that strange, because if you're doing in in HW, doing hash
lookup for flow and adding packets and bytes to the counter is cheap.
It's expensive having lot of those flows, but incrementing their
packet and byte counter isn't.

I know that all JNPR Trio kit (MX, T, EX9k...) do 1:1. I guess if
you're doing it in LC CPU things are very different.

-- 
  ++ytti