Subject: Re: NetFlow cf RTFM

From: Nevil Brownlee <[email-masked]>
Date: Wed, 8 Nov 2000 11:09:55 +1300 (New Zealand Daylight Time)

Hello Danny:

On Sun, 29 Oct 2000 22:54:46 +1300 (NZDT) [email-masked] 
wrote:

> I'm writing a brief description for my faculty on how this uni charges
> network traffic. Basically the uni is presented with a bill from AARNet
> based on NetFlow accounting in the AARNet routers. However that accounting
> is not down to the subnet-level or below, so UQ runs its' own accounting
> system. I don't know the details but believe this is based on NeTraMet. The
> results don't always agree.
> 
> Anyway for my own interest is there a broad comparison between NetFlow &
> RTFM available?
.............
> how does the following sound?
> 
>   NB NetFlow is somewhat similar to the Real-Time Flow Metering (RTFM)
>   described in several RFCs and available in the NeTraMet package.
>   While it's a more general approach than NetFlow, they are sufficiently
>   close that NeTraMet can act as a data collector for NetFlow routers.
..............
> PS are NeTflow & RTFM diverging or converging over timne?

As far as I know, no-one's written a comparison between the two.
Your paragraph has it the wrong way round.  The story is:

1. NeTraMet implements the RTFM architecture, which is a generalised,
   distributed approach to measuring traffic flows.  It's based on the
   idea that an RTFM meter sees every packet, which can allow the meter
   to build statistical information about flow behaviours (see RFC 2724)

   NetFlow summarises flows, sending data records at intervals set by 
   the router configuration.

2. The RTFM Meter MIB is a Proposed Internet Standard (RFC 2720),
   NetFlow is a widely-used Cisco proprietary scheme for collecting
   data from Cisco touters and switches.

   NeTraMet implements the RTFM meter on many different flavours of
   Unix systems, and on Microsoft Windows.  There's no reason why -
   if RTFM/NeTraMet users would just press their vendors harder
   (along the lines "why don't you implement RFC 2720???") - the
   RTFM meter shouldn't be available in switches and routers.

3. NeTraMet includes a version of the RTFM meter which uses NetFlow
   data as input (instead of looking directly at packet headers) -
   this is 'NetFlowMet.'  This trades off fine time detail (e.g.
   for 10-second flow rate distributions) against having a meter
   which can grab NetFlow data from Cisco routers.

   Used this way, NeTraMet acts as a data collection/consolidation
   system for NetFlow data, in much the same way as cflowd.

   The advantage of using NetFlow data as input to NeTraMet is that
   you can get it from many interfaces on the router (remembering
   that there is a performance hit on the router when you turn NetFlow 
   on for an interface), wheras with NeTraMet you need a metering
   point on every network segment you want to measure traffic on.

Is that enough info for you?

Cheers, Nevil

+---------------------------------------------------------------------+
| Nevil Brownlee                     Director, Technology Development |
| Phone: +64 9 373 7599 x8941        ITSS, The University of Auckland |
|   FAX: +64 9 373 7021      Private Bag 92019, Auckland, New Zealand |
+---------------------------------------------------------------------P