In-line monitoring vs. NetFlow or sFlow

Plixer CEO Mike Patterson gives his take on the Net Optics - Jimmy Ray Purser video.

Michael Patterson - CEO of network performance vendor Plixer International provided all of the following blog information below in regard to the Jimmy Ray Purser video about Net Optics:

----------------------------------------------------------------------------------------------------------------------------------

Hi Brad,

I watched the demo. I like Jimmy Ray Purser and follow him on Twitter. In-line monitoring and link aggregation is a good business. Definitely a need for this in the IT field. I like Netflow as I don’t have to buy any hardware and because it's free on Cisco routers (keep in mind that I'm also biased because the product I make, Scrutinizer - is a network management tool that uses Cisco NetFlow, sFlow, Juniper J-Flow, IPFIX or NetStream to provide historical trends of traffic data across all critical network interfaces).

Collecting and analyzing NetFlow and sFlow is a very cost effective solution. Placing probes in a dozen or so places on the network is expensive to purchase and maintain. Most of the time the level of detail gained form NetFlow reporting is sufficient and packet capture only needs to be done in a few key locations. We are not saying replace packet analyzers entirely, we suggest augmenting them with more flow analysis.

Which is better, in-line monitoring or NetFlow? Like all loaded questions, it depends. What are you looking to capture?

In-line Monitoring

A - Inexpensive

1. Pass the uplink through a hub (not a switch) and then plug the packet capture device into the hub.
2. Setup port spanning (i.e. mirroring) of the uplink of the switch to another interface so that the packet capture device can see the traffic.

B - Investment (avoiding the word ‘expensive’)

1. Place an in-line appliance to capture/forward the traffic onto multiple destinations.

With hardware from vendors such as NetOptics, traffic can be duplicated out to multiple ports. Network Instruments and other vendors provide similar solutions.

View the solution brief: Net Optics and Cisco NAM

Net Optics Tap technology can also add value to the Cisco NAM solution by providing aggregation, regeneration, switching, media conversion, and filtering capabilities:

Enjoy the video below of Network World Cisco Subnet blogger Jimmy Ray Purser getting the lowdown about in-line monitoring from Net Optics:

NetFlow or sFlow Monitoring

If the goal is to gain insight into who or what is hogging bandwidth, enabling a flow technology on your switches or routers and forwarding the data to a collector/analyzer is a great alternative, however, you don’t get all the packet details.

A - NetFlow

NetFlow aggregates the data and basically gives you summarized information such as IP addresses, ports, protocol, total bytes and packet volume plus a whole bunch of other fields.

B - sFlow

sFlow provides the entire packet but, it is only sampling and it may not sample the packet you need.

Both are generally free and standards based (NetFlow = IPFIX). In short there is a market for both, depending on what you need to do.

What's your take on in-line monitoring vs. NetFlow or sFlow?

BradReese.Com Cisco Refurbished - Services that protect, maintain and optimize Cisco hardware
Contact: Brad Reese | Twitter: http://twitter.com/BradReese

1. Cisco board directors are at the epicenter of the Microsoft and Yahoo! deal
2. What business is Cisco in today?
3. HP scolds the Cisco unified computing system
4. Cisco CEO John Chambers to stay at Cisco for another decade or more?
5. Cisco buying Dell: Allan Leinwand's idea is brilliant
6. Chocolate icon Hershey fails at online retailing
7. Juniper tries to pound spike into Cisco's heart
8. Wall Street analyst suggests Cisco may recover lost market share during 1Q10
9. Does Cisco discriminate against CCIEs by not promoting them to management?
10. Cisco's Ottawa Bluesfest resonates with newly laid off Cisco employees in San Jose and Research Triangle Park
11. Is Cisco NetFlow the only solution for application management in a virtualized world?
12. Cisco multimillionaire goes broke, loses $300 million fortune
13. Cisco expected to guillotine more employees this Thursday
14. Why HP ProCurve is dismantling Cisco's market share on a deal-by-deal basis
15. Cisco lost market share in network security appliances and software in 1Q09
16. Cisco CEO John Chambers quacks up the Cisco workforce and is an Internet sensation to boot
17. The sudden and unexplained departure of Cisco data center marketing honcho, Douglas Gourlay
18. Is Marc Andreessen betting $300M against Cisco's successful acquisition model?
19. Enterasys NAC sales triple
20. View Brad Reese on Cisco Story Archives

• Cisco
• Data Center
• LANs / WANs
• Network Management
• Security
• Collecting and analyzing NetFlow and sFlow is a very cost effective solution
• I like Jimmy Ray Purser and follow him on Twitter
• I like Netflow as I don’t have to buy any hardware and because it's free on Cisco routers
• In-line Monitoring
• In-line monitoring or NetFlow?
• IPFIX or NetStream to provide historical trends of traffic data across all critical network interfaces
• Jimmy Ray Purser video about Net Optics
• Michael Patterson - CEO of network performance vendor Plixer International
• Net Optics and Cisco NAM
• Net Optics Tap technology can also add value to the Cisco NAM solution by providing aggregation
• NetFlow
• NetFlow = IPFIX
• NetFlow add-ons
• NetFlow or sFlow Monitoring
• Network World Cisco Subnet blogger Jimmy Ray Purser
• Plixer CEO Mike Patterson gives his take on the Net Optics - Jimmy Ray Purser video
• Scrutinizer - is a network management tool that uses Cisco NetFlow
• sFlow
• The level of detail gained form NetFlow reporting is sufficient
• We are not saying replace packet analyzers entirely