Netflow was initially developed by Cisco in its Quality of Service (QoS) program. It is a switching method that allows more efficient switching of packets according to the type of packet.
cflowd was developed to collect and analyze the information available from NetFlow flow-export. It allows the user to store the information and enables several views on the data. It produces port matrices, AS matrices, network matrices and pure flow structures. The amount of data stored depends on the configuration of cflowd and varies from a few hundred Kbytes to hundreds of Mbytes in one day per router.
A user can store flow information and view the data in different ways. cflowd can produce matrices by autonomous system and network, and tables by port number and Internet protocol. With this information, engineers can evaluate traffic flow patterns between nodes on their networks and other networks. Engineers also can analyze traffic by application (for example, Web vs. e-mail vs. streaming audio vs. FTP) as well as by protocol (TCP vs. ICMP vs. DNS, for example). Insights from these types of analyses can help ISPs manage current networks and plan future network upgrades.
The sFlow® protocol is a completely different animal. Easily configurable through SNMP, its primary objective is to be a statistical network monitoring tool. Lots of different performance counters can be monitored through the sFlow® protocol, and the biggest benefit of sFlow® comes from its infinite scalability in large networks under heavy loads; however this innovative statistical approach comes at a slight disadvantage in accuracy, granularity, and timing precision.
Jflow and Netflow are essentially identical. JFlow and CFlow are the same as CISCO Netflow v5. Only NetFlow v9 supports IPv6. Unlike NetFlow, the sFlow® protocol samples every N-th packet from the traffic stream, where N can be one-in-512, one-in-1024, etcetera. This means that some communications may slip by entirely undetected, and the sFlow® collector software will not know about them.
