Q. Flows is receiving Netflow records from an ethernet interface on our primary router which has been set to 15 Mbit, as that is the level of service from our MPLS provider.
The issue is that when I look at the Flows data for that interface, when network utilization was > 90% for more than 24 hours, the Flows window was showing an average of 3000 KB/sec (23 Mbit ). I have access to another tool, Cacti, which shows the same interface, over the same time frame, with an average of just over 14 Mbit utilization.
A. The Flows window should be showing traffic in both directions, incoming and outgoing on the interface up to a total of 30 Mbit. The arrow controls in toolbar specify whether to track top senders/receivers or bidirectional. There are senders and receivers on both sides of the link.
There is no way in Flows to isolate just the Tx or Rx traffic on a particular interface.
Both InterMapper and Cacti use ifInOctets and ifOutOctets to measure the average rate of traffic flowing over the link. This rate should be limited to 15 Mbit in each direction. Note that this is an average: if there are bursts of 100% that last a second or less, this will affect the average, but the average over the poll interval will remain less than 100%.
NetFlow sessions are tracked individually using absolute timestamps. As a result, the Flow data should show you the actual bursts. Note that the Flow accounting takes place in the router *before* the traffic is transmitted on the link, so Flows may be counting traffic that the link was unable to send. You can check to see if the peaks of data over 5000 KB/sec correlate with reports of Tx discards on the interface in question. InterMapper will log interface discards automatically in the Event Log.
