28 Mar
2024
28 Mar
'24
2:03 a.m.
On Wed, 27 Mar 2024 at 21:02, Peter Phaal <peter.phaal@gmail.com> wrote:
Brian, you may want to see if your routers support sFlow (vendors have added the feature over the last few years).
Why is this a solution, what does it solve for OP? Why is it meaningful what the wire-format of the records are? I read OP's question at a much higher level, about how to interact and reason about data, rather than how to emit it. Ultimately sFlow is a perfect subset of IPFIX, when you run IPFIX without caching you get the functional equivalent of sFlow (there is an IPFIX entity for emitting n bytes from frame as well as data). -- ++ytti