NetFlow: Difference between revisions

Revision as of 16:40, 17 September 2020

Revision as of 08:39, 20 September 2020

Line 68:

That is why some modern implementations of NetFlow use the Stream Control Transmission Protocol ([[Stream Control Transmission Protocol|SCTP]]) to export packets so as to provide some protection against packet loss, and make sure that NetFlow v9 templates are received before any related record is exported. Note that TCP would not be suitable for NetFlow because a strict ordering of packets would cause excessive buffering and delays.

The problem with SCTP is that it requires interaction between each NetFlow collector and each routers exporting NetFlow. There may be performance limitations if a router has to deal with many NetFlow collectors, and a NetFlow collector has to deal with lots ofmany routers, especially when some of them are unavailable due to failure or maintenance.

SCTP may not be efficient if NetFlow must be exported toward several independent collectors, some of which may be test servers that can go down at any moment.

Line 336:

This technology was advantageous for local networks. This was especially true if some of the traffic had to be filtered by an [[Standard Access Control List|ACL]] as only the first packet of a flow had to be evaluated by the ACL.<ref name="kentik">[https://www.kentik.com/blog/netflow-sflow-and-flow-extensibility-part-1 NetFlow, sFlow, and Flow Extensibility, Part 1]</ref>

NetFlow switching soon turned out to be unsuitable for big routers, especially Internet backbone routers, where the number of simultaneous flows was much more important than those on local networks, and where some traffic causes lots ofmany short-lived flows, like [[Domain Name System]] requests (whose source port is random for security reasons).

As a switching technology, NetFlow was replaced around 1995 by [[Cisco Express Forwarding]]. This first appeared on Cisco 12000 routers, and later replaced NetFlow switching on advanced IOS for the Cisco 7200 and Cisco 7500.