IPFIX flows

[Terry Burton]

On 10 September 2013 21:46, Joel Bergstein <jbergstein at riscnetworks.com> wrote:
> I have been looking at collecting netflow data from vSphere.  I’ve found
> that starting with 5.1, VMware no longer supports netflow v5 and will only
> send IPFIX packets.
>
> The argus site requests an email from those interested in IPFIX data, thus
> this email.
>
> Has there been much expressed interest in IPFIX?  What is the likelihood of
> this development moving forward?

Hi,

Likewise, at my workplace we performed a minor upgrade from VMware
vSphere ESXi 5 to 5.1 without realising that this would update the
NetFlow export format. Consequently our monitoring of the
virtualisation infrastructure is significantly degraded.

My very limited understanding is that the IPFIX train came off the
rails during the IETF standardisation process and is subsequently a
shadow of what it could have been. There are some previous discussions
on this list, for instance:

http://permalink.gmane.org/gmane.network.argus/4521

I have only had a passing interest in IPFIX until recently when it
sunk in that even today IPFIX is replacing earlier NetFlow formats in
proprietary products.

Understanding the bad taste associated with IPFIX, and not having much
coding effort available to assist with a implementation, we haven't
asked for support in Argus – but from a purely utilitarian
perspective, a definite yes please!


Many thanks,

Terry