This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Netflow bandwith issue

We are gathering netflow data from a couple of our routers.

However, we are finding that the netflow graphs seem messed up.


We have a limit on the WAN interface on 30mbit (due to carrier restrictions). But, we frequently see this spikes with traffic on the last hour graphs.

pastedImage_2.png

However, if we zoom out to last 24 hours, the graphs is correct.

pastedImage_1.png

Is this a GUI-bug or is there some error with our Solarwindsconfig, or maybe netflow data?

Have someone else experienced the same?

  • Majority of the time this is caused by not having the active timeout command configured on the Netflow sources.  Check to see if the commands below are configured.  The commands below are for Cisco devices but most other vendors also have this command available.

    By default most network devices export long-lived flows every 30 minutes which cause high spikes over what the circuit is configured for.  The recommended value is 1 minutes to ensure all Netflow cached data is exported every 1 minute.

    If using traditional Netflow version 5 this is the command

    ip flow-cache timeout active 1 ( in minutes)

    If you are using Flexible Netflow the command will be in the flow monitor configuration

    flow monitor NetFlow-Monitor
      description Original Netflow captures
      record ipv4
      exporter NetFlow-to-Orion
    cache timeout inactive 10
    cache timeout active 60 ( in seconds)