What's the difference, same data, different chart...

Question

Can anyone help me out here...apparently, I'm not understanding something. If I look at Endpoint traffic and Conversations charts on the "Netflow Node Detail" screen of a router, the Endpoint chart shows traffic peaking at 7.5Mbps on a 10Mb circuit and the Conversations chart shows that same time-frame with a peak of 4Mbps. (I've attached screenshots)

Thanks

Daniel

attachments.zip

framed · Answer

You may be right, it does appear doubled but I'm just doing ingress/egress flow capture on the WAN port.

bscherer · Answer

I dont know if it is related, but we actually have a ticket open in regards to reports showing incorrect data for NTA.   In our case we were trying to generate Tosid reports

The last update I had form my coworker is that is should be addressed in the next RC.

mesverrum · Answer

My guess is that the conversations is being reported from two interfaces, it looks like some of the lines from endpoints almost exactly double of the conversation chart, but not all of the colors that I can spot.  I'd try to investigate which of those items don't double and see what is different about them in terms of which interfaces would be used in the path and if those interfaces are set to export netflow ingress/egress/both compared to the ones that are doubling.

Something isn't set up right, I don't see that in my environment and haven't noticed it in any I worked on.

-Marc Netterfield

Loop1 Systems: SolarWinds Training and Professional Services

*                 LinkedIN: Loop1 Systems
*                 Facebook: Loop1 Systems
*                 Twitter: @Loop1Systems