Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Measuring traffic on switch port vs router sub-interface

Hello

We have been measuring the traffic passing through the switch port and the router sub-interface where the customer is connected. Which measurement would be more accurate to identify bandwidth usage? We would like to ensure that the individual client traffic matches up with the up link traffic and is also a measure of how accurate the NPM tool is.

Find more posts tagged with

Accepted answers

john.ta

The tool that better identifies bandwidth usage is Netflow Traffic Analyzer. It tells you what source and destination IP's are, what protocol and port it is on, lots of great detail. For Netflow to work it needs to be on a layer 3 interface, so it would be on the router.

In terms of strictly NPM, if you are looking to identify bandwidth utilization of a customer you want to look at close to the source/destination as possible. That would be the switchport. The router sub-interface would also include any other switchports on the same vlan and other additional broadcast traffic, etc. and would probably not be a good indicator of bandwidth utilization of a customer.

All comments

john.ta

dcman204

Thanks, that makes sense. We have certain customers who have multiple ports

on the same VLAN so from that aspect it makes more sense to do it on the

router sub-interface.

Thanks

dcman

On Wed, Jun 1, 2016 at 2:11 PM, john.ta <

john.ta

If you are interested in bandwidth stats aggregated together from several ports then you would want the router sub-interface, correct. That is all traffic on that vlan.

dcman204

Thanks, what confused me is that there was this one customer whose traffic

on the switchport was 54 Mbps and on the router sub-interface is 42 Mbps

when they have a single switch port on the VLAN. Would L2 header cause so

much more traffic ? WHat would be the size of the layer 2 headers, MAybe 20

bytes added to a 1500 byte IP payload. The proportion did not seem right.

On Wed, Jun 1, 2016 at 2:32 PM, john.ta <