Netflow not showing everything?

I'm trying to use NTA to analyze some strange traffic behavior. A lot of remote sites are showing constantly high transfer rates, but the graphs I'm seeing in NTA don't seem to quite add up to data rate. Is it possible a lot of exported flows are getting lost? How would I know?

Thanks!

Find more posts tagged with

Accepted answers

All comments

justinh

I don't have an answer, but I'm trying to track down the same thing you are. I have noticed that an interface that shows 12,000+ packets/sec over a 5 minute period only produces a flow cache of 552.7 packets/sec. I'm not sure how that adds up. Is there some kind of limitation regarding what netflow collects in the cache?

dperdue

You could be seeing a lot of traffic on ports that are not being monitored. Go into the Admin section on the website, then into NTA settings, then Application and Service Ports. From there you should see a new option in NTA3 to turn on monitoring of all ports.

Steve_Pfister

Thank you... I've just turned that on. Hopefully, that was the problem.

Thanks again!

--Steve