I've configured a cisco router with Netflow v9 and a Custom Netflow (v9) sensor to pick up the data which is working fine. I created a custom sensor so I could define my own traffic types so it is more relevant to what we run over our networks.

What I've noticed is that the bandwidth interface graph for our cisco router is quite different to the netflow graph. In that they seem to be sometimes out of sync e.g. a spike in bandwidth that shows in the interface sensor might show at 2pm and on the netflow sensor it will show maybe 15-30 minutes later. Also sometimes traffic spikes don't show at all on the netflow sensor.

Article Comments

Dear Conrad,

is this a Cisco ASA?

Best Regards.


Feb, 2011 - Permalink

Hi,

This is a Cisco 1841 with IOS c1841-ipbase-mz.124-1a.bin

Cheers.


Feb, 2011 - Permalink

Hallo,

what is the active flow timeout set to in the device and what is it set to in PRTG

the flow data is for the same interface you have the SNMP values for?

A delay between Netflow data and the SNMP graph is absolutely normal. That is the nature of Netflow.

That makes it hard to compare the graphs. Please compare the transfered volume over a period of an hour or a day. That should be about the same.


Feb, 2011 - Permalink