Cisco’s NetFlow vs. Inmon’s sFlow: Which will prevail?

In the quest for improved insight into network traffic, increasing numbers of administrators are turning to flow monitoring.

The question arises, however, which is better, sFlow or NetFlow?

Most major switch vendors are shipping equipment today with support for one or the other.

In this corner NetFlow

NetFlow started as a proprietary technology developed by Cisco Systems. It is included in Cisco's Internetwork Operating System (IOS), which comes embedded in its network hardware.

The most widely deployed is version 5; however, v7 and v9 are becoming increasingly popular.

Recently, the Internet Engineering Task Force released a proposed standard called IP Flow Information eXport (IPFIX), which is based on NetFlow v9's data export format. Vendors supporting NetFlow include Cisco, Enterasys Networks, Juniper Networks, Riverstone Networks (recently acquired by Lucent), Riverbed, Packeteer and many others.

"Supporting NetFlow to provide improved network visibility remains part of our wide-area data services strategy," said Alan Saldich - product marketing vp at Riverbed Technology. NetFlow is a technology whereby the router keeps track of all conversations inbound (version 5) on each interface it is enabled on. It examines packets based on seven key fields and if two packets match on all seven criteria, it assigns them to the same flow or conversation.

Once the conversation has ended or is summarized it is sent to the collector.

A single NetFlow packet can be very large and contains conversation details on anywhere from 24-30 conversations.

If NetFlow is properly configured and the hardware isn't overloaded, this technology can be nearly 100 percent accurate at representing who is communicating through the device while having a very small impact on the CPU.

The challenger sFlow

Like NetFlow, sFlow is a push technology that sends reports to a collector.

But, while NetFlow is a software based technology, sFlow uses a dedicated chip that is built into the hardware. This approach removes the load from the router or switch's CPU and memory. Originally developed by InMon Corporation, sFlow products have been available since 2002.

sFlow Agents and Collector

The above diagram shows the basic elements of the sFlow system.

sFlow Agents throughout the network continuously send a stream of sFlow Datagrams to a central sFlow Collector where they are analyzed to produce a rich, real-time, network-wide view of traffic flows.

Alcatel, Allied Telesis, Dlink, Extreme Networks, Foundry Networks, HP, Hitachi, NEC and a few others have devices with sFlow chips.

sFlow isn't nearly as widely deployed as NetFlow, so fewer collectors are available.

The most current version is Version 5; however, Versions 2 and 4 are also widely deployed at this time.

sFlow is a sample-only technology where every X packet is sampled, the length noted, the majority of the packet is discarded and off it goes to the collector.

Because the technology is sample based, accurate representation of 100 percent of the traffic per interface is nearly impossible.

Complex algorithms have been proposed to statistically manipulate the collected data to represent total traffic with a probability of accuracy.

Software Collectors

To access the data generated by either sFlow or NetFlow enabled devices will require a collector.

A Google search on either sFlow or NetFlow will drum up a plethora of vendors with collector analyzers, many of whom support the analysis of both.

There is also some decent freeware such as ntop, a network traffic probe that shows the network usage. Another popular collector is the Scrutinizer Flow Analyzer from Plixer International, which works with both NetFlow and sFlow data. "Many of our customers are running a mixed hardware environment. Although NetFlow has been far more popular, we decided years ago to support sFlow as well," said Marc Bilodeau – chief technology officer of Plixer International.

Use Both

Which standard should you support, sFlow or NetFlow?

The answer is probably both.

If you have a purely Cisco network, all you will need to support is NetFlow.

However, should you have both HP ProCurve switches and Cisco routers, then you would use sFlow for the switches and NetFlow for the routers.

It is not uncommon to see sFlow on the LAN and NetFlow on the WAN/Internet.

The commands to Activate NetFlow and sFlow are available via the hardware vendors.

Typically vendors selling collectors also list the necessary configurations.

Related Stories:

http://www.BradReese.Com