Votes:
Hi,
I'am monitoring a specific port on a HP procurve 2900 series with PRTG monitor. This with the Sflow sensor and also the snmp sensor. the snmp sensor shows realistic network traffic. The Sflow sensor shows almost double network traffic than the snmp sensor.
It looks like the Sflow is getting to much data. I saw on internet something about ingress and egress traffic, but not sure how this relates to Sflow.
any ideas?
Votes:
Hi there,
thank you for your reply and confirmation.
The Interface [48] filter should do the trick. It will include Ingress and Egress traffic for that interface:
Interface [48]
Best Regards,
Luciano Lingnau [Paessler Support]
Created on Oct 21, 2016 1:03:39 PM by
5 Replies
Votes:
Hello TCM,
thank you for your KB-Post.
The sensor may be accounting for traffic twice or may be including multiple interfaces. You can deploy toplists for interfaces, this will tell you to which interfaces the refereed flow traffic refers to.
You can also use Filters to separate Ingress and Egress traffic, otherwise it may be accounted twice depending on the set-up:
Best Regards,
Luciano Lingnau [Paessler Support]
Created on Oct 19, 2016 5:43:42 AM by
Last change on Dec 2, 2021 10:37:56 AM by
Votes:
Hello Luciano,
I have set the stream data logging to all stream data. The log file indicates that there is inbound and outbound traffic sampled.
192.168.160.251 15893 00-1F-FE-9B-5F-C0 192.168.10.28 445 00-21-F7-12-F2-00 354888 3009 0 192.168.10.1 48 65535 192.168.7.110 2598 00-1F-FE-9B-5F-C0 192.168.10.159 55054 00-21-F7-12-F2-00 38120 3010 0 192.168.10.1 48 65535 192.168.7.103 2598 00-1F-FE-9B-5F-C0 192.168.10.177 57309 00-21-F7-12-F2-00 55320 3010 0 192.168.10.1 48 65535 192.168.7.113 2598 00-1F-FE-9B-5F-C0 192.168.10.154 59396 00-21-F7-12-F2-00 53130 3010 0 192.168.10.1 48 65535
Nothing wrong with that i think. The sflow sensor compared to the snmp sensor, doesn's the snmp sensor fetches inbound and outbound?
Last change on Oct 20, 2016 7:47:50 AM by
Votes:
Hello, thank you for your reply.
Yes, the SNMP Traffic sensor does also poll Traffic IN and Traffic OUT (TX/RX).
Since you've enabled the all stream-data log, which interfaces do you see in the streamlog? Are you seeing multiple interfaces (or traffic that doesn't ingress or egress via the mentioned interface).
Alternatively, in PRTG you may deploy a toplist for interfaces, this will tell you to which interfaces the refereed flow traffic refers to.
Best Regards,
Luciano Lingnau [Paessler Support]
Created on Oct 21, 2016 8:48:02 AM by
Votes:
Hello,
When i look at the toplist off interfcaes i see multiple random interfaces besides interface 48, the interface i want to monitor. So it counts also the traffic coming from these other interfaces and thats why i see more traffic.
Should i set a include filter on the Sflow sensor of "Interface [48]" so it only looks at traffice originated from interface 48? Or is a include filter " InboundInterface [48]" required?
thanks in advance
Last change on Oct 21, 2016 1:02:34 PM by
Votes:
Hi there,
thank you for your reply and confirmation.
The Interface [48] filter should do the trick. It will include Ingress and Egress traffic for that interface:
Interface [48]
Best Regards,
Luciano Lingnau [Paessler Support]
Created on Oct 21, 2016 1:03:39 PM by
Add comment