Three sources.
Three different questions.
They are often presented as alternatives, or as a maturity ladder. They are neither. Each answers a question the others cannot, and choosing between them is really choosing which questions you will be unable to answer.
SNMP counts, NetFlow describes, and packet capture shows. SNMP polls device counters and answers "is this link busy, and is this device up". NetFlow summarises conversations and answers "who is talking to whom, and how much". Packet capture records the traffic itself and answers "what actually happened, and why did it take so long". The first two describe traffic in summary; only the third preserves the evidence — which is why the hard problems, the ones where nothing looks busy, are almost always solved at the third level.
What each one can and cannot do.
The useful comparison is not accuracy or overhead. It is which questions each source is physically capable of answering.
Counts what crossed an interface
Polled every 30 seconds to 5 minutes: bytes, packets, errors, discards, port state, CPU, memory, temperature. Universal, cheap, and supported by everything ever made.
Cannot tell you: which conversation, which application, or anything that happened between two polls.
Best for: availability, capacity trending, hardware health, and knowing something is down.
Summarises each conversation
The device exports a record per flow: source, destination, ports, protocol, bytes, packets, timestamps. sFlow samples rather than counting every flow, which trades exactness for scale.
Cannot tell you: latency, retransmissions, whether a handshake succeeded, or anything about the content or health of the session.
Best for: who is using the bandwidth, traffic patterns, capacity planning by application, spotting unusual peer relationships.
Records the traffic itself
A copy of the actual packets, with microsecond timestamps. Everything the other two derive from, before the derivation threw the detail away.
Cannot do: come from nowhere. It needs a capture point, storage, and — to be useful during an incident — to have already been running.
Best for: why something is slow, what happened during an incident, proving where the time went, and any question asked after the fact.
The combination is the point
SNMP tells you an interface is discarding. NetFlow tells you which conversations were crossing it. The capture tells you that the discards coincided with a burst from one host and cost that application 400 ms per transaction. None of the three produces that sentence alone.
The value is in the correlation, which requires the three to sit in one engine on one timeline rather than in three tools that disagree.
How they fit together.
Every monitoring platform collects the first. Many read the second. Very few correlate both against the packets — and the packet layer is what makes the other two worth trusting.
Why most platforms stop at two
- Packets are expensive to keep. Counters and flow records are tiny; a full capture is not. Retaining it is an engineering problem, and skipping it is the easy product decision.
- On-demand capture looks like a solution. Many tools can start a capture when you ask. That covers every problem except the ones you cannot reproduce — which are the ones you needed help with.
- Net-Monitor records continuously and analyses online. All three sources land in one engine on one timeline, so the answer comes from the same place regardless of which question you asked.
Short answers.
What is the difference between SNMP and NetFlow?
SNMP polls a device for counters — how many bytes crossed an interface, whether a port is up, what the CPU is doing. NetFlow is exported by the device and describes individual conversations: who talked to whom, on what port, for how many bytes. SNMP tells you a link is 80% busy; NetFlow tells you what is filling it.
Do I still need SNMP if I have packet capture?
Yes. Capture only sees traffic at the points where you capture, and it says nothing about device health — CPU, memory, temperature, power supplies, port state on links you are not watching. SNMP is cheap, universal and covers all of that. They are complementary, not competing.
Is sFlow as good as NetFlow?
For traffic patterns and capacity work, usually yes, and it scales better on high-speed links. Because it samples rather than accounting for every flow, it is weaker for security investigation and for anything involving small, rare or short-lived conversations — which is often exactly what an investigation is looking for.
How much storage does continuous packet capture need?
It depends on link rate, how much of that rate is actually used, and how long you need to keep it. There is no single figure worth quoting, which is why sizing is done per deployment from real traffic volumes rather than from a link's theoretical maximum.
Can packet capture see encrypted traffic?
It can see everything except the payload, and the envelope carries most of what diagnosis and anomaly detection need: who talked to whom, when, how much, at what rate, whether the handshake succeeded, which TLS version was negotiated and whether the certificate was accepted.
Related questions.
Not sure which layer you are missing?
The quickest way to find out is to point all three at your own network for an afternoon and see which one produces the answer.