sFlow vs NetFlow vs IPFIX: Network Monitoring Protocols Compared

Every serious network needs traffic visibility, and the three protocols you will meet are sFlow, NetFlow and IPFIX. They are often used interchangeably, but they are architecturally different: sFlow is packet sampling performed on the switch ASIC with counters, while NetFlow/IPFIX are flow-export protocols that build flow records. Choosing the wrong one can leave you blind to DDoS attacks or drown your collector in data. This article compares the three, shows configuration examples on Cisco and Arista, and gives practical guidance for traffic analysis, capacity planning and security monitoring.

The Three Protocols in Brief

• NetFlow (Cisco, v5/v9): the switch/router builds flows (5-tuple sessions) and exports them to a collector over UDP 2055. v9 adds templates.
• IPFIX (RFC 7011): the IETF-standardized successor of NetFlow v9, widely supported (Cisco, Huawei, Juniper, Arista).
• sFlow (RFC 3176): statistical packet sampling (e.g., 1 in 8192) done in hardware, plus periodic interface counter polling - no flow state on the device.

Comparison Table

Configuring sFlow on Arista EOS

switch(config)# sflow sample 16384
switch(config)# sflow polling-interval 30
switch(config)# sflow destination 10.0.0.5 6343
switch(config)# sflow source-interface Management1
switch(config)# sflow run

sample 16384 = sample 1 packet in 16384; polling-interval 30 exports interface counters every 30 seconds.

Configuring NetFlow on Cisco IOS

flow record FLOW-1
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 collect transport tcp flags
 collect interface output
!
flow exporter EXPORTER-1
 destination 10.0.0.5
 source Loopback0
 transport udp 2055
!
flow monitor MONITOR-1
 record FLOW-1
 exporter EXPORTER-1
 cache timeout active 60
!
interface GigabitEthernet0/1
 ip flow monitor MONITOR-1 input

Choosing What to Run

• Fabric-wide visibility on many switches → sFlow: stateless, cheap, scales to every ToR.
• Detailed per-flow security analysis → NetFlow/IPFIX on the edge and core.
• DDoS detection at high speeds → sFlow sampling on all edge ports feeding a detection engine (FastNetMon etc.).
• Multi-vendor standardization → IPFIX (Huawei: netstream with IPFIX export; Juniper: flow-active-timeout under forwarding-options).

Practical Collector Tools

• nfdump/nfcapd - the classic NetFlow/IPFIX collector and CLI analyzer.
• sflowtool - converts sFlow to text/NetFlow for downstream tools.
• FastNetMon - open-source DDoS detector supporting sFlow, NetFlow and IPFIX.

Related: Zabbix SNMP monitoring for network devices and tcpdump packet capture guide.

原文链接：https://sflow.org/