Hi Jaime, what follows is just my personal opinion. NetFlow v9 and sFlow v5 are the two versions of the families thought to be extendible and, thus, encapsulate custom informations into the datagrams. Theorically, you can transport whatever you like by just taking care of the size constraints. For example, pmacct actually use them to transport classification labels.
The original NetFlow protocol is "flow" oriented, this is right. But imagine you have control of both the NetFlow v9 agent and collector, you can use the protocol as skeleton, say, to transport environmental temperature of your agents, latencies, lost packets, whatever. In NetFlow it turns out to be a "dirty work", that is, your doubt has a strong basis. Actually, sFlow has an elegant way to deal with this: sFlow datagrams can include a variety of samples, ie. flow, counters and custom ones. Each sample has its own shape. Then, if the collector understands a kind of sample, that's it; otherwise, it just skips such sample and checks for the next one in the datagram, if any. Said this all, then, it's just matter of gathering meaningfully and reliably such extra data into the xFlow agent. Cheers, Paolo On Thu, Sep 21, 2006 at 01:47:02PM +0200, Jaime Nebrera wrote: > Can a NetFlow probe send data of such things as lost packages, > latency, syn/ack, connections that really were established, etc? Of > course I understand we will provably need v9 for this. My main doubt is > NetFlow is "flow" oriented while this stuff is "packet" oriented. _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
