EDA support sflow in ver 6.0?


#1

Guy

Most switches of my customer are only supporting sflow, not netflow. So I wonder whether EDA in version 6.0 is supporting sflow or not. Could you please clear my question?

Thanks in advanced
Jaeseog


#2

Hi Jaeseog,

At this time, ExtraHop does not support sFlow. What make/model of switches are in use? Knowing this will help us prioritize future investments in collecting flow-based data.

Thanks,
Ted


#3

G’day Ted,

I’m not the OP, but thought I’d mention one vendor supporting sFlow is F5.

We work with many customers using their BIG-IP App Delivery Controllers, though not many are using sFlow.

It puts out typical interface/system/VLAN stuff, as well as HTTP which is a bit unique vs. an sFlow switch or router.

If EH did support sFlow, it would be useful for F5 customers who have BIG-IP deployed in sites/networks without an EH Discover listening. If EH is seeing all the same networks, obviously there’s no benefit.

Related: F5’s AFM (firewall) module can also output Netflow v9, though don’t have that 100% working with EH 6.0 yet.

  • mdk

#4

Hi

sFlow is very common to L3 switch vendors like DellForce10, Brocade, Arista, Huawei, F5 and Alcatel-Lucent. And Juniper is also supporting sFlow in their L3 switch.

IMHO, we also need to support sFlow because it will take more year IPFIX to be the standard of flow protocol.

Regards,
Jaeseog