Re: Real world sflow vs netflow?

[Łukasz Bromirski <lukasz () bromirski net>]

On 7/14/12 11:15 AM, Mikael Abrahamsson wrote:
> On Sat, 14 Jul 2012, Łukasz Bromirski wrote:
>
> > NetFlow, jFlow, IPFIX deal with flows. You can discuss sampling
> > accuracy and things like that, but working with flows is more accurate.
>
> If you do 1:1000 sampling with both Netflow and sFlow, why would one of
> them be more accurate than the other? If you analyze the flow on the
> device or on the collector (as might be done with sFlow), I don't see
> why one would be btter than the other.

Sure, but with sampling you'll loose accuracy anyway. The difference is
subtle, and depends on the (Net|j)Flow implementation - on some devices
for sampled NetFlow you'll still get sampled FLOWS (1:x) not sampled
PACKETS (thus disregarding the flow advantage).

--
"There's no sense in being precise when |               Łukasz Bromirski
 you don't know what you're talking     |      jid:lbromirski () jabber org
 about."               John von Neumann |    http://lukasz.bromirski.net