I have sensors setup on a router to monitor a specific router interface using both SNMP and Netflow 5.
The SNMP polling is set for 1 minute intervals while the Netflow 5 Active Flow timeout is also set to 1 min.
On the Overview screen however, my SNMP sensor reports about 30Mbps while the Netflow sensors reports about 6Mbps.
Why such a discrepancy for the same interface ?
Also, I noticed that the SNMP Bandwidth summary is expressed as Inbound + Outbound....which can be confusing at times because I usually think of having for instance a 45Mbps T3 in both directions.
Hello,
comparing the results of different monitoring "protocols" is always tricky. The current speed values should not be compared, they can differ too much alone due to the active flow timeout. Furthermore, please bear in mind that SNMP also accounts the Netflow packets, which Netflow itself does not, it only tells you about the actual 'payload'.
However, if you compare the volumes, for at least full hours or even full days, the volumes should be very similar between SNMP & Netflow.
best regards.
Jan, 2013 - Permalink