We have a number of edge routers/firewalls configured to send netflow v9 data to our probes. Additionally, we are monitoring interface traffic on these devices. We are noticing that the netflow and interface traffic show similar trends and patterns, indicating that the netflow data is coming in accurately, but the netflow data is reporting higher bandwidth amounts than the interfaces (somewhere around 10-20% higher).

Regarding the netflow data: - Active timeout is configured on the devices at 1 minute and the netflow sensors are configured to 2 minutes, per the prtg instructionals. - Interface filters are configured to separate active interfaces into separate sensors. Ingress and egress traffic is being pulled in per interface sensor for netflow data.

Given our configuration, I would presume that the bandwidth totals would more closely match between the interface sensors and the netflow sensors, but they don't among all measured devices. The traffic patterns between the two sensors for a given device don't match perfectly, so I know that the bandwidth totals won't be exact, but the netflow sensors are consistently higher than the interface sensors by about 10 or 20%. I'm wondering why this might be (some kind of netflow overhead?) and if there's anything we can do to try and more closely align those sensors so reported bandwidths match more closely.

Article Comments

Hello Kyle,

Huh, interesting, usually we get the question the other way round, meaning traffic reported by flows is lower than by SNMP traffic sensors :)

I'll send you an email with further instructions what we can do analyze this further.

Kind regards,

Erhard


Mar, 2018 - Permalink

Thank you Erhard!


Mar, 2018 - Permalink

We followed up with Kyle via a support case.

In the end, the issue appears to have been the export rules on the device. Upon a closer look, PRTG was reporting exactly the double of the data reported by the SNMP Traffic sensors. Kyle contacted the vendor and they have identified that both interfaces (LAN and WAN) were exporting both ingress and egress flow.

This results as PRTG reporting "double" the data, since traffic flowing from the WAN to LAN will be reported once as ingress on the WAN interface and a second time as egress on the LAN interface, resulting in exactly double of the expected traffic.

Best Regards,
Luciano Lingnau [Paessler Support]


Mar, 2018 - Permalink