On 7/14/12 11:15 AM, Mikael Abrahamsson wrote:
On Sat, 14 Jul 2012, Łukasz Bromirski wrote:
NetFlow, jFlow, IPFIX deal with flows. You can discuss sampling accuracy and things like that, but working with flows is more accurate.
If you do 1:1000 sampling with both Netflow and sFlow, why would one of them be more accurate than the other? If you analyze the flow on the device or on the collector (as might be done with sFlow), I don't see why one would be btter than the other.
Sure, but with sampling you'll loose accuracy anyway. The difference is subtle, and depends on the (Net|j)Flow implementation - on some devices for sampled NetFlow you'll still get sampled FLOWS (1:x) not sampled PACKETS (thus disregarding the flow advantage). -- "There's no sense in being precise when | Łukasz Bromirski you don't know what you're talking | jid:lbromirski@jabber.org about." John von Neumann | http://lukasz.bromirski.net