We have a number of edge routers/firewalls configured to send netflow v9 data to our probes. Additionally, we are monitoring interface traffic on these devices. We are noticing that the netflow and interface traffic show similar trends and patterns, indicating that the netflow data is coming in accurately, but the netflow data is reporting higher bandwidth amounts than the interfaces (somewhere around 10-20% higher).
Regarding the netflow data: - Active timeout is configured on the devices at 1 minute and the netflow sensors are configured to 2 minutes, per the prtg instructionals. - Interface filters are configured to separate active interfaces into separate sensors. Ingress and egress traffic is being pulled in per interface sensor for netflow data.
Given our configuration, I would presume that the bandwidth totals would more closely match between the interface sensors and the netflow sensors, but they don't among all measured devices. The traffic patterns between the two sensors for a given device don't match perfectly, so I know that the bandwidth totals won't be exact, but the netflow sensors are consistently higher than the interface sensors by about 10 or 20%. I'm wondering why this might be (some kind of netflow overhead?) and if there's anything we can do to try and more closely align those sensors so reported bandwidths match more closely.
Add comment