This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Questions regarding Top 5 Applications

Hello guys, and thanks for such an awesome community. I've recently bought NPM and NTA for our business, and I'm currently using it to monitor 10 different Cisco 7206VXR WAN routers. I'm exporting both ingress and egress from both the WAN side and LAN side of the 11 different routers. The whole product seems to be working flawless as it is now, but I have some questions that might be obvious for experienced users but not-so-obvious for me as a rather new NPM/NTA and netflow in general user.

In the Top 5 Applications section of the main NTA dashboard, I see the 5 expected applications which is a good thing. My #1 application, is a regional web proxy port that is being used on all of my 11 locations. However, during peak times the amount of traffic under "BYTES" can show as much as 200GB+, and the default time span is 2 hours. Does this mean that my WAN routers sees 200GB+ within the given time period? This sounds rather unreal, as I "only" have Gigabit interfaces on each side (WAN/LAN) of the routers, and thats a whole lot of HTTP/proxy traffic even for 10 rather busy routers. The next application on the list only counts as much as 10GB within the same (default) time period.

Am I missing something, or would you say this is theoretically/practically possible? Or am I just interpreting the chart wrong?

 

Best regards,

Vidar S

  • What is the interface utilization you see on our WAN/LAN Gbps interfaces?

    1 Gbps = 0.125 GB per second

    0.125 GB/s * 60 s/min * 60 min/hr = 450 GB/hr possible (assuming 100% utilization)

    This of course doesn't take into account any overhead and that fact the interface probably isn't fully utilized, but it's certainly seems possible.

  • Thanks Chris for the answer emoticons_happy.png

    The weird thing is that I seldom see any of the Gbit interfaces above 10% utilization. So I'm having problems seeing how its possible with a low utilization like that. I first thought it might be a bug with ingress/egress duplicates, but I don't know. I just found the amount of traffic completely off from what I see from other types of traffic. Although the traffic I'm seeing is HTTP proxy traffic, which is likely what I should expect seeing the most of.

     

    Best regards,

     

    Vidar S

  • Can you login to the router, reset the counters, and then do a show interfaces after 15 mins to see amount of traffic in/out.   Then, compare this to what you see in NTA to see if it's in the ballpark for the same interfaces.

  • I will look into it and do as suggested once I get back at work, so we can investigate further. Thanks alot :)