What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags


View all Tags

Netflow w/Sonicwall NSA3500 -bandwidth disparity

Votes:

0

Monitoring a Sonicwall NSA3500 via netflow5 sensor and my toplists look great, but my graphs are not reporting properly. For example if I add up 15mins of toplist traffic I have around 5GB of data transferred between IP's as I would expect, but if I look at the live graphs for the same time period I will see 4MB transferred for the entire hr, with peak speeds of 0.03Mbits. Its like the graphs are actually just reporting the udp netflow packets it receives instead of the contents of the netflow datagrams. This behavior is the same whether I do a netflow sensor with or without filters.

netflow prtg sonicwall

Created on Aug 31, 2012 8:59:39 PM



3 Replies

Votes:

0

Hello,

seeing as this seems to be a Sonicwall device, there might be an explanation, that Sonicwall does send slightly different Netflow9-packets which do not fully comply with the standard of Cisco Netflow 9 packets (for which the sensors are developed for).
The Toplists "ignore" the Active Flow Timeout, but the normal sensor results do not, so it's very likely that this is an issue with the Sonicwall sending packets with a "wrong" active flow timeout (compared to the setting in the Sensor).
Unfortunately, as we do not have Sonicwall devices in our lab, we can't test this, but we've seen some cases where the Sonicwalls were not properly working with Netflow 5 or 9 sensors.

best regards.

Created on Sep 3, 2012 1:49:58 PM by Torsten Lindner [Paessler Support]



Votes:

0

Hi, I know this is an old post, but I am having the same problem with a SonicWALL device. Do you have any new information or configuration advice regarding the data variance in the Live data reporting (when compared to the Top Talkers/Connections/Protocols)

Created on Sep 28, 2015 12:26:36 AM



Votes:

0

I'm very much afraid we have seen similar cases with Sonicwall devices sending Flow/IPFIX-Data. They do not seem to send 100% standard complying flow-data (what PRTG expects in terms of Cisco Netflow 9 or IPFIX standard). Some of our users who experienced similar issues with Sonicwall were able to solve this with changing the active flow timeouts on the sending devices and in PRTG. It should be worth to try this. Otherwise we can only suggest to consult with Sonicwall directly.

Created on Sep 28, 2015 1:23:47 PM by Torsten Lindner [Paessler Support]




Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.