Re: sFlow vs netFlow/IPFIX

["Roland Dobbins" <rdobbins () arbor net>]

On 29 Feb 2016, at 16:59, Pavel Odintsov wrote:

> I have only one question. Why you against sFLOW protocol telemetry 
> with so huge passion ? :)

Because I've had very poor experiences with it.  And it doesn't seem to 
scale very well.

> Actually, sflow is not so popular as netflow. But to be honest it's
> pretty young standard in compare with netflow and it implements
> slightly different approach.

sFlow has been around for a while, though.  It isn't new.

> So IX could not use netflow even if they want.

This depends upon the devices utilized - there are actually some devices 
which can export layer-2 NetFlow.

There are other issues with NetFlow as it's currently generally 
implemented which are also concerns with IX scenarios, FYI.  I will 
leave it as an exercise for you to find out what they are.

> But you vote for "sflow is weird protocol and you should avoid it".

My view is that it's generally better to use NetFlow or IPFIX, where and 
when possible.

> How IX could monitor traffic if they haven't netflow? So if they
> follow your recommendations they should drop idea about traffic
> monitoring at all :)

Straw man.  I never said that nor implied it.  If sFlow is all that's 
available, then of course operators can and should use it.

> But actually in modern network world every technology has applicable 
> usage and it's
> not good idea to avoid it just because your religion (I'm speaking
> about netflow religion) prohibit it for you.

It isn't 'religion'.  It's based upon the fact that a) my experiences 
with sFlow have been suboptimal and b) sFlow isn't generally available 
on large routers used at network edges.

> Actually you are writing this email from company email and I could 
> conclude it's Arbor vision and is not your own.

No, that is incorrect.  I speak only for myself.  And as I previously 
noted, Arbor products support sFlow, and have for many years; I'm just 
not a big fan of it.

> Could you clarify it?

I just did.

> Could I use your vision as Arbor's vision in public speeches / 
> presentations?

No, you may not, per the above.  Arbor is telemetry-neutral; we aim to 
support all relevant telemetry formats in line with the expressed needs 
of our customers.  And that includes sFlow.

These trollish, passive-aggressive rhetorical tactics grow wearisome.  I 
will not reply any further to this thread, so as to avoid further 
spamming the list.

-----------------------------------
Roland Dobbins <rdobbins () arbor net>