8 Replies Latest reply on Jan 4, 2017 4:25 AM by asaputra

    How can I have netflow top application report match the NPM interface utilization report?

    asaputra

      As the title said, how can I have netflow top application report match the NPM interface utilization report?

       

      I am asking this because I want it when NPM reports me that my bandwidth got high utilization, I can tell what kind of application traffic that is utilizing that much of bandwidth at that time.

      However, I got confused as the total utlization number between netflow top application chart and NPM interface percent utilization chart is different

       

      for example:

      I have a 40 Mbps bandwidth from my ISP (I have modified the bandwidth to 40Mbps in the node configuration from fast ethernet default 100Mbps)

      My router is cisco 1800 series, I only have flow enabled both ingress & egress in one interface of the router, i also have configured ip flow-cache timeout active 1

       

      From this graph I can know that between 13:10 - 13:14 my link is utilized 43,47% (recv) and 45,65% (xmit)

       

      However, if I observe the total utilization from netflow top applications graph in the same time range is not the same. For example, in below graph:

       

       

      Total traffic inbound 27.54% + 19.49% + 0.3% + 0.03% = 47.36% --> compared to inbound 43,47%

      Total traffic outbound 37.02% + 4.64% + 1.05% + 0.02% + 0.01% = 42,74%--> compared to outbound 45,65%

       

      From what I can say, I dont limit my application monitoring only to only monitor some specified apps, so the traffic recorded in netflow should be all traffic that are "passing" that interface right?

      And I can confirm that there are no bandwidth shaper appliance between the links, so everything is as it is.

       

      Please kindly advise.