Netflow Graphs are Incorrect for an Interface

I have an router interface that is 3 bonded T1 circuits, so the total bandwidth is 4.6 mbps for that interface. The graphs for the interface in NPM are fine. The graphs in Netflow are incorrect. We had a spike in usage. NPM graph was 4.5 mbps. The Netflow graph showed a spike of 60 mbps. I have it sorted for last 15 minutes, ingress only.

Does anyone have ideas about how/why this is happening?

Here's my flow command on the router.

ip flow export destination 192.168.2.1 2055 source eth 0/1

Thanks,

Sillz

Find more posts tagged with

netflow_traffic_report

bandwidth_graph

adtran

Accepted answers

All comments

vispetto

Sillz,

Change the source from the LAN interface (eth 0/1) to the MFR interface or Loopback address (if applicable). Below is a netflow config with a MLFR from a Cisco 2821.

<route>#sh run | i flow

ip route-cache flow

ip flow-export source Loopback0

ip flow-export version 5

ip flow-export destination <IP> 2055

choly

Hi Sillz,

behavior you've described corresponds to quite common mistake done in device settings - exporting flows interval is not set to 1 minute. For Adtran device you should includeip flow cache timeout active 1 to device config.

For more details and config examples please see SolarWinds Knowledge Base :: NetFlow Interface resource(s) show utilization peaks higher than NPM utilization or higher than the interface bandwidth.