What Are NetStream and sFlow? What Are Their Differences?
NetStream and sFlow supported by CE switches are both used to collect statistics on and analyze traffic on the network.
NetStream collects packet statistics based on flows. It samples inbound and outbound traffic on each interface, classifies network traffic based on the key factors in packets (for example, source IP address, destination IP address, source port number, and destination port number), and filters as well as aggregates data. Users can customize templates to classify and collect statistics on network traffic.
sFlow is a traffic monitoring technique that collects and analyzes traffic statistics based on packets. It provides complete traffic information from Layer 2 to Layer 4. Network administrators can analyze traffic transmission on the data center network in real time to quickly detect abnormal flows and locate the source of attack traffic. This ensures stable running of the data center network.
The following table compares NetStream and sFlow.
| NetStream | sFlow |
|---|---|
| NetStream can be deployed at the access, aggregation, or core layer based on service requirements to learn about the service types on the network, network traffic characteristics, and network running status. With NetStream, users can detect network structure defects or performance bottlenecks in a timely manner. | sFlow can be deployed at the access, aggregation, or core layer based on service requirements to analyze traffic transmission on the data center network in real time. With sFlow, users can quickly detect abnormal flows and locate the source of attack traffic. |
| NetStream is completely based on flows. (For example, if two packets belong to the same flow, they are recorded in one flow and the flow status is reserved before flow statistics exporting.) | sFlow is not completely based on flows. (The flow status is not reserved.) |
| The cache is required for NetStream and its capacity affects NetStream performance. The cache increases costs. | The cache is unnecessary. The ASIC chip directly delivers received packets to the CPU, which then exports the data to the sFlow collector. |
| This method is flexible. Users can customize a template to obtain key information in network traffic. | This method is inflexible, and no template can be customized. |