Trouble interpretting Netflow data stats. They appear to be twice as much as expected.

Hi dan-uk,

We can probably figure it out with a little more info.  Which NetFlow report are you reffering to? What version of NTA? How many NetFlow exporters do you have configured in the transfer path and are the both ingress and egress?

Andy

Hi Andy

Thanks for getting back to me.  The Netflow report is NetflowInterfaceDetails.aspx

Am running version of Netflow 3.5

On the router itself :

********#sh ip flow interface
FastEthernet0/0
  ip route-cache flow
  ip flow ingress
  ip flow egress
FastEthernet0/1
  ip route-cache flow
  ip flow ingress
  ip flow egress

ip flow-export version 5
ip flow-export destination xxx.xxx.xxx.xxx 2055

IOS : c2801-spservicesk9-mz.124-22.T.bin

Only exporting data to a single Orion box.

Is this what you needed ?

Regards

Dan

Something must be wrong.  No way you should even be getting the max.  Protocol overhead and retrasmissions should eat away at the max pretty good.

Also do not forget there is a difference between megabits and megabytes but I think you have denoted those properly.

The math you've done appears to be correct.  My suspicion is that the traffic report is showing the total for bidirectional traffic.  Is this a full-duplex link?  If so, would I be correct in assuming that the link is getting pegged in both directions during that 12 hour period?  Just shooting in the dark here...

Hi ,

Yes the link is full-duplex.  However, when you separate out the charts into Ingress and Egress, its only reporting a few hundred MB's incoming.  The replication is still showing the 16GB egress only (see attached screen grabs.

 INGRESS  = 424MB's

EGRESS = 16.2 GB's

You can see the top two 16GB values

Any thoughts ?

What are you doing to separate out ingress versus egress?

Just used the flow direction selector on the page to separate out the streams.

Dan,

This is a complete shot in the dark, but could the way you have the flow exports set up be causing the duplicate information?  It looks like you've got both ip route-cache flow and ip flow ingress/egress set up on your interfaces.  Ip route-cache flow and ip flow ingress do the same thing, but I'm wondering if having both statements causes your device to export the data twice.  Just a random guess!

Just used the flow direction selector on the page to separate out the streams.

Can you post a screenshot of this?

Sorry for the delay

I'm a poor overwork engineer ;-)    I just selected the flow dicrection to produce the separate stats.

I'm still concerned that the stats I'm looking at are correct and not double.

The reason I spotted this was because I knew the link was maxed out, therefore could work out what should be transferred as a maximum and could then see that netflow was reporting twice as much.  Had this been a reading from a nominally used link, you might easily be reading it as twice as much but thinking it was accurate.  Can't have the customer forecasting bandwidth requirements based on 200% of the actual amount being transferred, hence my concern.