[ovs-discuss] sFlow versus NetFlow

[Peter Phaal]

Thanks for the reference. The paper is behind the IEEE pay wall, so I thought I would give a quick summary. 

The authors  compare CPU overhead due to NetFlow and sFlow on Open vSwitch as they vary link speeds and sampling rates. iperf is used as the traffic generator. The paper contains graphs showing increasing CPU load due to sFlow monitoring when using sampling rates in the range 1-in-100 to 1-in-1. Similar effects are not seen in the case of NetFlow.

When interpreting the results there are a few points worth considering:

1. Typical sFlow sampling rates for the 100Mbps, 1Gbps, and 10Gbps links tested in the paper would be 1-in-500, 1-in-1000 and 1-in-2000 respectively. At these sampling rates there is no appreciable CPU overhead shown in the graphs.
http://blog.sflow.com/2009/06/sampling-rates.html

2. Using iperf as the load generator means that only one flow is created. Generating a large number of small flows would likely change the results for NetFlow and would have no effect on the sFlow results (since sFlow is is a packet based, and not a flow based measurement).
http://blog.sflow.com/2009/05/measurement-overhead.html
Note: This is also a traffic pattern that puts greater stress on OVS whether you have monitoring enabled or not.


There are valid use cases where you may want to see every packet. In these cases a hybrid OpenFlow / sFlow solution is worth considering:
http://blog.sflow.com/2013/04/sdn-packet-broker.html

Properly configured, sFlow is extremely scaleable, making it possible to centrally monitor every physical and virtual link in a large data center:
http://blog.sflow.com/search/label/scalability

In its introduction the paper mentions the important role that measurement plays in the context of software defined networking. Low measurement latency is extremely important if the measurements are going to provide feedback to the cloud orchestration system (a topic not addressed by the paper):
http://blog.sflow.com/2013/01/rapidly-detecting-large-flows-sflow-vs.html

Finally, for anyone interested in building performance aware SDN controllers, the following articles explore different applications for sFlow:
http://blog.sflow.com/search/label/SDN

Peter

On Jun 19, 2013, at 12:12 PM, Wes Felter <wmf at felter.org> wrote:

> Check out Mann, V.; Vishnoi, A.; Bidkar, S., "Living on the edge: Monitoring network flows at the edge in cloud data centers," Communication Systems and Networks (COMSNETS), 2013 Fifth International Conference on , vol., no., pp.1,9, 7-10 Jan. 2013
> http://dx.doi.org/10.1109/COMSNETS.2013.6465540
> 
> This paper compares NetFlow and sFlow performance on OVS.
> 
> -- 
> Wes Felter
> IBM Research - Austin
> 
> _______________________________________________
> discuss mailing list
> discuss at openvswitch.org
> http://openvswitch.org/mailman/listinfo/discuss

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://openvswitch.org/pipermail/ovs-discuss/attachments/20130619/b7514664/attachment.html>