23

How is sFlow different from netFlow, and how is each supported by different vendors ?

Improve this question

4 Answers 4

Reset to default
21

NetFlow is a protocol for exporting aggregated IP flow totals. As such it is well suited to IP traffic accounting on Internet routers. With Netflow V9 (AKA IPFIX it can look into Layer 2 traffic as well)

sFlow is a general purpose network traffic measurement system technology. sFlow is designed to be embedded in any network device and to provide continuous statistics on any protocol (L2, L3, L4, and up to L7), so that all traffic throughout a network can be accurately characterized and monitored. These statistics are essential for congestion control, troubleshooting, security surveillance, network planning etc. They can also be used for IP accounting purposes.

Netflow mirrors all traffic, and places a load on the CPU when utilised.

SFlow is a packet sampling technology where the switch captures every 100th packet (configurable) per interface and sends it off to the collector. sFlow is built into the ASIC, and places minimal load on the CPU.

Netflow supported by Cisco, Juniper, Alcatel Lucent, Huawei, Enterasys, Nortel, VMWare

sFlow supported by Alaxala, Alcatel Lucent, Allied Telesis, Arista Networks, Brocade, Cisco, Dell, D-Link, Enterasys, Extreme, Fortinet, Hewlett-Packard, Hitachi, Huawei, IBM, Juniper, LG-Ericsson, Mellanox, MRV, NEC, Netgear, Proxim Wireless, Quanta Computer, Vyatta, ZTE and ZyXEL (see sFlow link)

Improve this answer
2
  • 1
    The sampling concept applies to netflow/ipfix just as it does with sflow
    – Brad Hein
    Commented Jul 7, 2017 at 12:38
  • Sampling aside, how would two packets from the same traffic differ on Netflow and sFlow. Maybe compare them with a raw packet from say, tcpdump? The difference still isn't crystal clear to me.
    – Nagev
    Commented May 10, 2018 at 9:11
7

The sole difference being "NetFlow is Cisco proprietary, sFlow is not" isn't exactly correct.

NetFlow originally started out as Cisco proprietary, but kind of went the same way as GRE or EIGRP. Since NetFlow v5 it has been implemented and supported on other vendors' hardware.

The main difference between NetFlow and sFlow is that NetFlow is restricted to IP only, whereas sFlow has the ability sample everything (network layer independent).

EDIT: The above appears to be no longer correct (at least as of the IPFIX standard). I've found the following blog post (warning: seems to be an "sflow" specific URL, so take it with a grain of salt if you wish) does a pretty good job of outlining the differences between the IPFIX spec and sFlow

Improve this answer
5
  • 4
    NetFlow v9 and v10 (IPFIX) send periodically template message which tells how to read the samples, this template is very flexible and can be extended arbitrarily. iana.org/assignments/ipfix/ipfix.xml shows what standard supports today, and ethertype, dmac, smac etc are there already. sFlow otoh is static, if sFlow5 does not support what you want to do, you need whole new sFlow protocol, while in IPFIX you don't need to change the protocol at all.
    – ytti
    Commented May 27, 2013 at 15:43
  • Very interesting! Thanks for the link. Shows how much I've been keeping up with NetFlow. :-) I wonder what sFlow has coming down the pike. Would seem like "sFlow fans" would just say "anything over Ethernet" as a counter-argument to having to define new IPFIX fields. There's also the numerous sampling algorithms that NetFlow/IPFIX uses vs sFlow's just one.
    – John Jensen
    Commented May 27, 2013 at 15:52
  • 1
    As an FYI, L2 netflow is available on a number of Cisco platforms with the use of v9 or, more recently, IPFIX.
    – rnxrx
    Commented May 28, 2013 at 1:30
  • Thanks but this was already pointed out in the comments above. :-)
    – John Jensen
    Commented May 28, 2013 at 1:34
  • 1
    An independent vendor with deep knowledge on the subject says this: plixer.com/blog/netflow/…. You should also consider if a given platform runs NetFlow/sFlow in hardware or software.
    – generalnetworkerror
    Commented May 29, 2013 at 5:58
2

Cisco devices try to aggregate flows (you can think of them as conversations) and then export information about them to a collector. This requires memory to cache these.

sFlow has two major components: one where it will periodically export statistics like interface counters and CPU usage to a collector, and one where it will randomly capture 1 in N (configurable, usually 512 up to 32768) frames that pass through a router, and export the first 256 bytes. You can then perform statistical analysis on traffic flowing through your network.

sFlow packet samples are enhanced with information from the routing table such as AS paths. It is also v4 and v6 agnostic, unlike NetFlow, which forces you into an uncomfortable compromise depending on what type of data you want to receive.

NetFlow suffers from dating back to an era where flow-based routing was not yet considered a joke; sFlow suffers from not being a TLV format so implementing vendor extensions in a portable way is close to impossible.

Improve this answer
1
  • Some misleading comments here... NetFlow uses cache, and it can be aggregated/not aggregated, sampled or not - those are characteristics of data you're gathering and it's up to you to define it.NetFlow data can also contain data "such as AS paths" and it's not sFlow differentiator and never was.NetFlow was only prototyped as flow-switching solutions, it was almost immediately switched to information-gathering mechanism.In terms of real differences, there's big difference in sampling: in sFlow sampling is done per-packet, not per-flow, you immediately loose accuracy.Look in cisco-nsp@ archives.
    – Łukasz Bromirski
    Commented May 29, 2013 at 17:29
0

Netflow is a Cisco proprietary protocol and as such is not supported by anything other than Cisco devices.

sFlow is an IETF standard for doing pretty much the same thing but in a standard that isn't owned by one particular manufacturer.

Improve this answer
1
  • 2
    AFAIK sFlow is no longer IETF but 'sFlow consortium' product. IPFIX is IETF standard netflow v9 (version number bumped to v10 and minor changes). I guess major difference is that sflow exports single packet (with well defined sampling methodology) and you'll do the extrapolation, while IPFIX/netflow can do lot of other things, including that, but can also aggregate data for you. I'd say netflow/IPFIX is much more flexible, which also means you could implement netflow/IPFIX in your gear in a way which would make it useless, while sflow is quite strict in how it must be implemented.
    – ytti
    Commented May 27, 2013 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.