In the quest for improved insight into network traffic, increasing numbers of administrators are turning to flow monitoring.
The question arises, however, which is better, sFlow or NetFlow?
Most major switch vendors are shipping equipment today with support for one or the other.
In this corner NetFlow
NetFlow started as a proprietary technology developed by Cisco Systems. It is included in Cisco's Internetwork Operating System (IOS), which comes embedded in its network hardware.
The most widely deployed is version 5; however, v7 and v9 are becoming increasingly popular.
Recently, the Internet Engineering Task Force released a proposed standard called IP Flow Information eXport (IPFIX), which is based on NetFlow v9's data export format. Vendors supporting NetFlow include Cisco, Enterasys Networks, Juniper Networks, Riverstone Networks (recently acquired by Lucent), Riverbed, Packeteer and many others.
 "Supporting NetFlow to provide improved network visibility remains part of our wide-area data services strategy," said Alan Saldich - product marketing vp at Riverbed Technology. |
NetFlow is a technology whereby the router keeps track of all conversations inbound (version 5) on each interface it is enabled on.
It examines packets based on seven key fields and if two packets match on all seven criteria, it assigns them to the same flow or conversation.
Once the conversation has ended or is summarized it is sent to the collector.
A single NetFlow packet can be very large and contains conversation details on anywhere from 24-30 conversations.
If NetFlow is properly configured and the hardware isn't overloaded, this technology can be nearly 100 percent accurate at representing who is communicating through the device while having a very small impact on the CPU.
The challenger sFlow
Like NetFlow, sFlow is a push technology that sends reports to a collector.
But, while NetFlow is a software based technology, sFlow uses a dedicated chip that is built into the hardware. This approach removes the load from the router or switch's CPU and memory. Originally developed by InMon Corporation, sFlow products have been available since 2002.
sFlow Agents and Collector
The above diagram shows the basic elements of the sFlow system.
sFlow Agents throughout the network continuously send a stream of sFlow Datagrams to a central sFlow Collector where they are analyzed to produce a rich, real-time, network-wide view of traffic flows.
Alcatel, Allied Telesis, Dlink, Extreme Networks, Foundry Networks, HP, Hitachi, NEC and a few others have devices with sFlow chips.
sFlow isn't nearly as widely deployed as NetFlow, so fewer collectors are available.
The most current version is Version 5; however, Versions 2 and 4 are also widely deployed at this time.
sFlow is a sample-only technology where every X packet is sampled, the length noted, the majority of the packet is discarded and off it goes to the collector.
Because the technology is sample based, accurate representation of 100 percent of the traffic per interface is nearly impossible.
Complex algorithms have been proposed to statistically manipulate the collected data to represent total traffic with a probability of accuracy.
Software Collectors
To access the data generated by either sFlow or NetFlow enabled devices will require a collector.
A Google search on either sFlow or NetFlow will drum up a plethora of vendors with collector analyzers, many of whom support the analysis of both.
 There is also some decent freeware such as ntop, a network traffic probe that shows the network usage. Another popular collector is the Scrutinizer Flow Analyzer from Plixer International, which works with both NetFlow and sFlow data. |
"Many of our customers are running a mixed hardware environment. Although NetFlow has been far more popular, we decided years ago to support sFlow as well," said Marc Bilodeau – chief technology officer of Plixer International.
Use Both
Which standard should you support, sFlow or NetFlow?
The answer is probably both.
If you have a purely Cisco network, all you will need to support is NetFlow.
However, should you have both HP ProCurve switches and Cisco routers, then you would use sFlow for the switches and NetFlow for the routers.
It is not uncommon to see sFlow on the LAN and NetFlow on the WAN/Internet.
The commands to Activate NetFlow and sFlow are available via the hardware vendors.
Typically vendors selling collectors also list the necessary configurations.
Related Stories:
Brad Reese cofounded BradReese.Com Cisco Refurbished, which enables affordable networks globally by assuring customer satisfaction with guaranteed one year warranties on both Cisco Repair as well as Refurbished Cisco.
Don't be shy, contact Brad Reese online or call him Toll Free:
866-864-0506
International callers may wish to call Brad by dialing:
850-364-4115
The Leader in Network Knowledge
