0

Recently I'm investigating the solutions for ip flow monitoring, and come across a lot of pages talking about different solutions and trade-offs between netflow, sflow, IPFIX, etc. In short, netflow/IPFIX gives better accuracy for micro or transient traffics, while sflow covers more generic traffic pattern and could scale better in terms of resource usages and its sampling flexibility. Also, there are trends of adding the ip flow monitoring on individual hosts themselves like what Cumulus NetQ solution does. Given these overwhelming information, I would like to ask some general questions on this front:

  1. Generally, are we locked into the either sflow or netflow solution exclusively, or we could do hybrid solutions like sflow on the switch, while having netflow for server hosts. How does the data aggregation normally works in this sense.
  2. For host related ip flow traffic, I suppose the functionality of it should bundle with protocols like LLDP to collect which interface on the remote switch it connects to, which functions as an add-on to the switch flow monitoring. Not sure if there is any existing solutions for this.
Improve this question
3
  • 1
    A lot depends on your network equipment. Normally, you run either NetFlow or SFlow on your network devices, and you configure it on the network device interfaces. Configurations on hosts/servers can be asked about on Server Fault, but that is off-topic here.
    – Ron Maupin ♦
    Commented Feb 3, 2021 at 1:05
  • Thanks @RonMaupin for your response. I asked this mainly because I have heard that Netflow will put much burden on the switch, and more vendors supports sflow compared to netflow other than Cisco. Therefore, I felt sflow is a better alternative to collect the ip flow from network devices side. However, sflow is known to be less accuracy to catch micro-trends, so I think pairing it with netflow collected from hosts will be beneficial, but not sure how it goes if we mangle the two results together.
    – lordofire
    Commented Feb 3, 2021 at 21:19
  • 1
    That really does not make much sense. You will be getting redundant information and trying to mix the two would be a mess. In any case, it does not matter what you run on the network devices (switches switch in hardware, and NetFlow does not really add all that much to a switch CPU, which is not what does the switching). Running something on the hosts too is redundant, but independent from what you run on the network devices. In any case, the hosts are off-topic here.
    – Ron Maupin ♦
    Commented Feb 3, 2021 at 21:31

1 Answer 1

Reset to default
0

Basically, it depends on what your hardware supports unless you're planning to renew anyway.

NetFlow restricts you much to Cisco hardware (regardless of whether that's a good or a bad thing). IPFIX support is still somewhat scarce. sFlow support across device vendors is broader, so that might be the most promising path.

Flow monitoring on/in hosts isn't usually required because you can see physical traffic on the switches and you can easily drill down to the L3 or L4 level. Looking inside virtual switches is its own beast, so you might want to look into specialized monitoring there.

Whether you can combine data from different protocols depends on your analysis software. There are various packages that support multiple protocols (recommendations are explicitly off-topic here, sorry).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.