I've configured a cisco router with Netflow v9 and a Custom Netflow (v9) sensor to pick up the data which is working fine. I created a custom sensor so I could define my own traffic types so it is more relevant to what we run over our networks.
What I've noticed is that the bandwidth interface graph for our cisco router is quite different to the netflow graph. In that they seem to be sometimes out of sync e.g. a spike in bandwidth that shows in the interface sensor might show at 2pm and on the netflow sensor it will show maybe 15-30 minutes later. Also sometimes traffic spikes don't show at all on the netflow sensor.
Add comment