why does 100 MB file being copied from one computer to another computer gives different size readings in netflow

Looking for an explanation why a 100 MB file being copied from one computer to another computer gives different size readings (230 MB) when checking the netflow stats with orion. The folder transfer is across a WAN connection. I have notice is using Microsoft-DS 445.

Find more posts tagged with

netflow_conversation_length

netflowetflow

Accepted answers

All comments

mcbridea

A good deal of that is probably protocol overhead. The MTU restricts packet size so the 100 MB gets chopped up into many packets with headers, retransmissions and so forth.

michaelbooker

Where would I find detailed documentation that supports what you are saying in your post? Also a chart that show a cross reference of different overhead according to each protocol.

darragh.delaney

Hi there. As has been mentioned in the previous response some of this could be down to protocol overhead. It does seem a lot to result in over double the file size. My thoughts on this is that you may be double counting or there is something else going on between the two Microsoft systems that makes up the other traffic. Double counting can occur if you are monitoring both systems, you don’t mention what the source of the flow data. If it is a switch and you are monitoring both the client and the server ports then you could be counting the traffic twice.

If you want to get further visibility into this traffic the company where I work (NetFort.com) has developed a DPI tool which integrates with Solarwinds Orion. As we do DPI you can drill-down into the Microsoft-DS 445 traffic and find out what files are been transferred between the two systems. Over the years we have picked up on other background copy operations which results in extra data on networks. You could download a trial version to find out what files are been transferred between the two systems or get a visibility into any background operations

michaelbooker

the source of the flow data comes from a RIVERBED device.

darragh.delaney

I not going to claim to be an expert on RIVERBED so excuse my basic questions.

Just wondering what ports you are monitoring on the RIVERBED. Are you monitoring both the input and output ports?

mcbridea

Can you post the NTA screen you are using.