New Question
 
 
PRTG Network Monitor

Intuitive to Use.
Easy to manage.

300.000 administrators have chosen PRTG to monitor their network. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free PRTG
Download >>

 

What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

 

Top Tags


View all Tags


Sflow sensor shows more traffic than the snmp sensor

Votes:

0

Your Vote:

Up

Down

Hi,

I'am monitoring a specific port on a HP procurve 2900 series with PRTG monitor. This with the Sflow sensor and also the snmp sensor. the snmp sensor shows realistic network traffic. The Sflow sensor shows almost double network traffic than the snmp sensor.

It looks like the Sflow is getting to much data. I saw on internet something about ingress and egress traffic, but not sure how this relates to Sflow.

any ideas?

network-monitoring sflow snmp-traffic

Created on Oct 17, 2016 2:32:42 PM by  TCM (0) 1



Best Answer

Accepted Answer

Votes:

0

Your Vote:

Up

Down

Hi there,
thank you for your reply and confirmation.

The Interface [48] filter should do the trick. It will include Ingress and Egress traffic for that interface:

Interface [48]

Best Regards,
Luciano Lingnau [Paessler Support]

Created on Oct 21, 2016 1:03:39 PM by  Luciano Lingnau [Paessler Support]



5 Replies

Votes:

0

Your Vote:

Up

Down

Hello TCM,
thank you for your KB-Post.

The sensor may be accounting for traffic twice or may be including multiple interfaces. You can deploy toplists for interfaces, this will tell you to which interfaces the refereed flow traffic refers to.

You can also use Filters to separate Ingress and Egress traffic, otherwise it may be accounted twice depending on the set-up:



Best Regards,
Luciano Lingnau [Paessler Support]

Created on Oct 19, 2016 5:43:42 AM by  Luciano Lingnau [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hello Luciano,

I have set the stream data logging to all stream data. The log file indicates that there is inbound and outbound traffic sampled.

192.168.160.251	15893	00-1F-FE-9B-5F-C0	192.168.10.28	445	00-21-F7-12-F2-00	354888	3009	0	192.168.10.1	48	65535
192.168.7.110	2598	00-1F-FE-9B-5F-C0	192.168.10.159	55054	00-21-F7-12-F2-00	38120	3010	0	192.168.10.1	48	65535
192.168.7.103	2598	00-1F-FE-9B-5F-C0	192.168.10.177	57309	00-21-F7-12-F2-00	55320	3010	0	192.168.10.1	48	65535
192.168.7.113	2598	00-1F-FE-9B-5F-C0	192.168.10.154	59396	00-21-F7-12-F2-00	53130	3010	0	192.168.10.1	48	65535

Nothing wrong with that i think. The sflow sensor compared to the snmp sensor, doesn's the snmp sensor fetches inbound and outbound?

Created on Oct 19, 2016 12:40:30 PM by  TCM (0) 1

Last change on Oct 20, 2016 7:47:50 AM by  Luciano Lingnau [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hello, thank you for your reply.

Yes, the SNMP Traffic sensor does also poll Traffic IN and Traffic OUT (TX/RX).

Since you've enabled the all stream-data log, which interfaces do you see in the streamlog? Are you seeing multiple interfaces (or traffic that doesn't ingress or egress via the mentioned interface).

Alternatively, in PRTG you may deploy a toplist for interfaces, this will tell you to which interfaces the refereed flow traffic refers to.

Best Regards,
Luciano Lingnau [Paessler Support]

Created on Oct 21, 2016 8:48:02 AM by  Luciano Lingnau [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hello,

When i look at the toplist off interfcaes i see multiple random interfaces besides interface 48, the interface i want to monitor. So it counts also the traffic coming from these other interfaces and thats why i see more traffic.

Should i set a include filter on the Sflow sensor of "Interface [48]" so it only looks at traffice originated from interface 48? Or is a include filter " InboundInterface [48]" required?

thanks in advance

Created on Oct 21, 2016 12:04:14 PM by  TCM (0) 1

Last change on Oct 21, 2016 1:02:34 PM by  Luciano Lingnau [Paessler Support]



Accepted Answer

Votes:

0

Your Vote:

Up

Down

Hi there,
thank you for your reply and confirmation.

The Interface [48] filter should do the trick. It will include Ingress and Egress traffic for that interface:

Interface [48]

Best Regards,
Luciano Lingnau [Paessler Support]

Created on Oct 21, 2016 1:03:39 PM by  Luciano Lingnau [Paessler Support]



Please log in or register to enter your reply.


Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.