cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post

Understanding the difference between NetFlow and IP SLA

Level 12

One of the most common things I'm asked to explain is the difference between Cisco IP SLA and NetFlow. At a glance, they have a lot in common:

  • They're both supported on many Cisco devices (routers, swithes, firewalls, etc)
  • They both can help you understand network performance, especially on the WAN
  • Network management applications like Orion and the SolarWinds free tools support both

All that said, the similarities mostly end there...

NetFlow
Let's for a moment group all flow technologies including NetFlow, JFlow, sFlow, and IPFix together and just call them "NetFlow" to keep things simple. NetFlow is a feature on your routers and switches that analyzes the traffic that is going in one interface and out another to tell you things like the source and destination IP addresses, the protocol, the application (really source and destination ports), the amount of data being sent/received, and so on. NetFlow's primary purpose is to help you understand the bandwidth consumption on your network. It answers the questions of "who is using my bandwidth and what are they doing with it?"

NetFlow can't tell you about things like application performance, response time, errors, jitter, and packet loss. Remember - its job is to help you analyze bandwidth consumpiton; not to help you analyze network performance.

Cisco IP SLA
IP SLA is very different from NetFlow. Cisco IP SLA is a feature on your routers and switches that allows you to configure these devices to run tests from their location on the network. The tests, called operations, are used to take measurements of network performance and reachability. For instance, you may want to know how HTTP traffic going to google.com varies from your different WAN locations. You can use IP SLA to measure this from the edge routers in those sites. You might also use IP SLA to measure latency, jitter, MOS, DNS performance, and etc.

The devices run these operations on a scheduled basis and store the results in memory. Then, you use a network management system like Orion to pull the data back to a central location for analysis, alerting, and reporting.

The sweet spot...
Ultimately, you'll want to be able to use both NetFlow and IP SLA together so that you have a complete picture of network performance. In a perfect world, IP SLA tells you where you have issues and what they are - NetFlow tells you why.


Flame on...
Josh
Follow me on Twitter

3 Comments
Level 13

Hello from cisco live 2013

we are in an ip sla session they are  telling to use ipfix to collect stats and not the Cisco MIB

can Vnqm and nta collect both min and ipfix?

will the product move from mib to ipfix?

can we get options to enable infix?

Level 15

Interesting and educational.

MVP
MVP

agreed...both are tools in the toolbox.