On Sat, Jul 14, 2012 at 1:30 AM, Łukasz Bromirski <lukasz@bromirski.net> wrote:
sFlow is really sPacket, as it doesn't deal with flows.
NetFlow, jFlow, IPFIX deal with flows.
I am a puzzled by the orthodoxy that seems to prevail around the value "flows" as a measure of network traffic in packet switched networks. The following article contains some thoughts on flow oriented and packet oriented measurements. Apologies to NANOG readers for the simplistic analogies used to describe packet switching, the article is also intended for server administrators and application developers who often don't really know what happens when they write some bytes to a TCP socket. http://blog.sflow.com/2012/09/packets-and-flows.html The article positions flows as a useful abstraction for characterizing host and application performance, but as a poor fit for understanding packet traffic and measuring the performance of packet switches and routers. This isn't really an issue of sFlow vs. NetFlow/IPFIX etc. Either protocol can be used to export both types of measurements; the question is what types of measurement should be exported. What do people think? Peter