Recently I'm investigating the solutions for ip flow monitoring, and come across a lot of pages talking about different solutions and trade-offs between netflow, sflow, IPFIX, etc. In short, netflow/IPFIX gives better accuracy for micro or transient traffics, while sflow covers more generic traffic pattern and could scale better in terms of resource usages and its sampling flexibility. Also, there are trends of adding the ip flow monitoring on individual hosts themselves like what Cumulus NetQ solution does. Given these overwhelming information, I would like to ask some general questions on this front:
- Generally, are we locked into the either sflow or netflow solution exclusively, or we could do hybrid solutions like sflow on the switch, while having netflow for server hosts. How does the data aggregation normally works in this sense.
- For host related ip flow traffic, I suppose the functionality of it should bundle with protocols like LLDP to collect which interface on the remote switch it connects to, which functions as an add-on to the switch flow monitoring. Not sure if there is any existing solutions for this.