NBAR2 vs Netflow

Hi,

Reaching out to see if anyone has noticed large differences between NBAR2 and Netflow data.

I've been trying to figure out which source I should use when trying to establish utilisation.

Should the data be the same? I appreciate NBAR covers more layers but I would have thought it would be close just more detailed around the type of traffic.

Attached are two graphs from the same interface on a router. NBAR2 and Netflow.

Thanks

Adam

attachments.zip

Find more posts tagged with

netflow

nbarvsnetflow

nbar_monitoring

data

Accepted answers

All comments

deverts

Wow, this conversation is fairly deep in content and there is no simple answer. The 2 compliment each other, and it's not really an either/or solution. Netflow is "simply" conversations that flow through an interface; ALL conversations. NBAR looks at the protocols passing through the interface, and classifies them according to protocol definitions. Depending on the OS (IOS vs IOS-XE, even versions within each), you will see differences. Cisco will need to develop a way to internally map the data and include it in the flow data, then Solarwinds will need to develop a way to extract that data and display it in NTA, which I think may be coming:

NBAR2 or Next Generation NBAR - Cisco

What I've actually started doing is using Netflow for conversations and volume numbers, and using NBAR to assist with application mapping. I then take the mapping and create IP Groups in NTA that "sorta" aggregate the info into common themes. It's not a perfect science, but it's closer...I haven't been able to map the 2 like-for-like exactly.

ebradford

Just a small clarification. Traffic passing through a Layer-3 interface creates flow. Traffic passing through a Layer-2 interface does not create flow.