Conversations resource traffic doesn't match interface utilization charts

orionfan

Over the last couple of days, we have seen a WAN link get saturated and NPM is showing 95-100% utilization as expected. When I look at the conversations resource to view what is causing the traffic, the statistics don't match up. Here is the Netflow configuration.  I have also attached the screenshots of the interface utilization and conversations, and you can see the difference in that the Conversations resource is only showing 2Mbps as the maximum speed.

flow record NTArec

match ipv4 tos

match ipv4 protocol

match ipv4 source address

match ipv4 destination address

match transport source-port

match transport destination-port

match interface input

collect interface output

collect counter bytes

collect counter packets

collect application name

!

!

flow exporter servername

destination x.x.x.x

source Loopback0

transport udp 2055

template data timeout 60

option application-attributes timeout 300

option application-table timeout 60

!

!

flow monitor NTAmon

description NetFlow/NBAR

exporter servername

cache timeout inactive 30

cache timeout active 60

record NTArec

interface x/x

ip flow monitor NTAmon output

attachments.zip

rschroeder

Is there a chance you might be missing applying your Netflow reporting configuration on all of the L3 interfaces?  For example, if you have it monitoring a WAN port, is it also monitoring all the L3 routing interfaces (or sub-interfaces)?  That may give you the increased granularity you need to see what's consuming the WAN bandwidth.

Are you also monitoring Netflow on the remote router, so you can compare in bits and out bits and ensure they match up?

I ask these two questions because I've seen cases where a WAN provider mistakenly broadcasts data from their equipment towards our routers, resulting in seemingly high spikes of throughput that don't correlate with our actual traffic coming to the routers from the switches behind them.

I set up our L3 equipment to share data on every L3 interface, as well as on the uplink/downlink ports between routers & switches.  That seems to have been the most reliable and granular way to correctly identify source and destination traffic as I troubleshoot WAN congestion.