I am graphing traffic passing through a Cisco router, and it seems as though bandwidth utilization on the Netflow sensor is double what is displayed by the interface. For instance, the interface graph will show 2mb peak usage, while the netflow graph will show 4kbits/s at the same time. Is there an explanation for this behaviour?
Netflow sensor shows double bandwidth usage?
Modified on 2025-06-10 14:08:23 +0200
Disclaimer:
The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.
The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.
There will always be differences in the way that the data is displayed when you are comparing Netflow Traffic Reports vs the SNMP interface reports due to the way that the information is sent or retrieved by the PRTG server.
SNMP delivers the information for the interface based on the scanning interval of the sensors while the Netflow data is sent to the PRTG server and then broken down from the larger chunk of data. Also, Netflow sends the overall payload of the device not the specific amount of traffic over one port. If you compare the two over longer periods of time like the 2 day graph or more, the data should be more similar.
Sep, 2013 - Permalink