Perhaps one of the best ways to answer the question: what is IPFIX, is to start by explaining what short comings NetFlow has that necessitated the evolution of this IETF standard. Probably a good understanding of what is NetFlow is also in order as IPFIX is almost an exact copy of NetFlow with a few significant differences.
NetFlow vs. IPFIX
Two of the largest features that come to mind when trying to discern the differences between NetFlow v9 and IPFIX are:
- IPFIX allows a vendor ID to be specified whereby the vendor can stick proprietary information into a flow and export anything they want. The same details that are traditionally sent with syslogs or collected via SNMP could be exported in IPFIX.
- IPFIX allows for variable length fields and NetFlow doesn't. This is useful if you want to export HTTP host, URLs, or messages.
As you can see below, IPFIX allows for variable length stings. To do the same with NetFlow meeting setting aside a fix column size which usually ends up with wasted space with every flow leading to an inefficient use of disk space.
Contrary to popular belief, Flexible NetFlow is not a new version. Rather it is an interface for configuration NetFlow v9 or even v5 or another version of NetFlow. It isn't however limited to NetFlow technologies at all. It can even be used to configure IPFIX or packet sampling similar to sFlow.
What is IPFIX
If the brief description above didn't provide enough detail on the differences between NetFlow and IPFIX or if you are looking for more technical documentation on the differences between NetFlow and IPFIX, consider reading the IPFIX RFCs 5101 and 5102 which are derived in part from the NetFlow version 9 RFC.
Vendors who make the mistake of supporting NetFlow in lieu of IPFIX never thought to ask the question: What is IPFIX? If they had they wouldn't have turn to netflow. See Riverbed NetFlow Support to understand some of the problems vendors can run into when they don't make the switch to IPFIX. Even Cisco Systems the inventor of NetFlow is making the switch to IPFIX.
|Vendors who did ask the question "What is IPFIX?" and made the switch to export it include but, are not limited to:|
IPFIX isn't just another name for NetFlow v10, it's an open standard that allows vendors to liberate themselves from the constraints of NetFlow. It is the catalyst in networking for the freedom of exportation. In other words, IPFIX is an enabler technology that allows vendors to export any performance detail they can dream up.