Re: Real world sflow vs netflow?

[Joe Loiacono <jloiacon () csc com>]

Peter Phaal <peter.phaal () gmail com> wrote on 07/13/2012 04:20:45 PM:

> 2. sFlow: Packets are randomly sampled in hardware and the packet
> headers are immediately exported as sFlow datagrams - there is no flow
> cache on the switch/router. In addition to exporting the packet
> header, the sFlow agent captures the FIB state associated with
> forwarding the sampled packet, exporting information such as next hop
> router, AS-path, communities etc

What about byte counts? Just those in the sampled packet (i.e., no running
totals per flow)?

> In contrast, the sFlow standard specifies how sampling must be performed
> and ensures that information is included that allows the sampled data
> to be correctly scaled and produce unbiased measurements.

Does sflow software typically recreate the total byte count per flow (e.g.,
TCP session) by scaling?

Thanks,

Joe