Flow data is the backbone of network observability: compact records describing conversations — source, destination, ports, protocol, bytes, packets — exported by the devices already in your racks. But "flow data" is not one thing. The three protocols you will actually encounter make meaningfully different trade-offs.

NetFlow: the accountant

NetFlow (v5 and the far more flexible v9) tracks every flow through the device. The router maintains a flow cache and exports a record when the flow ends or times out.

Strengths: complete accounting. If a host moved 40 GB overnight, NetFlow saw all 40 GB. Ideal for capacity planning, billing, and security forensics where "approximately" isn't good enough.

Costs: maintaining the flow cache costs device CPU and memory, and on very high-throughput links, full accounting can become the bottleneck — which is why sampled NetFlow exists.

sFlow: the pollster

sFlow doesn't track flows at all. It samples packets — one in N — and ships the headers to the collector immediately, along with interface counters.

Strengths: nearly zero device overhead at any line rate, which is why it dominates on data-center switches. Counter export is built in. And because samples ship instantly, it's effectively real-time.

Costs: it's statistics, not accounting. At 1-in-2048 sampling, a short conversation may never be sampled at all. Fine for spotting the top talkers saturating a link; wrong for proving exactly which bytes left the building.

IPFIX: NetFlow, standardized

IPFIX is the IETF standard that grew out of NetFlow v9, with flexible templates that let vendors export custom fields — application IDs, NAT translations, firewall verdicts. If your devices support it, it is generally the best-behaved option, and any modern collector ingests NetFlow and IPFIX side by side.

Practical guidance

  • WAN edge and branch routers → NetFlow/IPFIX. Volumes are manageable and full accounting matters at the edge.
  • Data-center and campus switching → sFlow. Line-rate visibility with negligible overhead.
  • Mixed estate → collect both. Any collector worth deploying (ours included) speaks all three on standard ports — 2055 for NetFlow/IPFIX, 6343 for sFlow — and normalizes the records into one queryable stream.

The protocol matters less than the habit: once per-conversation visibility is a query away instead of a packet capture away, most "what is eating this link?" mysteries stop being mysteries.