How do you know if the NetFlow collector is saving or even getting all of the NetFlow datagrams that are being sent to it or that it is receiving? It is important to know if any flows are missing.

Why do we care?

This is a great question. We care because a loss of flow exports is usually caused by one of three things:

1. The network dropped some packets
2. The router can’t keep up
3. The NetFlow receiver / collector can’t keep up

NetFlow sequence numbers are becoming increasingly important. When building a NetFlow collector it is important that the engine scales while staying accountable. If you look at the NetFlow v9 packet format you will notice something called the package_sequence.

Read more »

JFlow is a IP traffic flow sampler technology used by Juniper manufactured routers and switches. JFlow is considered a flow sampler technology much like Sflow, and when enabled on an interface; it allows packets in the input stream to be sampled. As the packets flow through an input stream the router/switch will look at each one, but only records new packets and discards any packets it has already seen.

JFlow is just one of three flow technologies available; among the 3 include Cisco’s Netflow and HP’s Sflow technologies. Each having their own strengths; Netflow records all packets while SFlow will only sample incoming traffic based on the packet ratio defined in the router configuration.

Milton