Q. We have an ATM bundle made of two T1's that we are monitoring. When calculated in KBps, two T1's in both directions totals 772 KBps, so I don't understand why the graph I have shows that we are getting more than 1,200 KBps at a specific time of day.
A. It's because of the way that NetFlow (and other flow technologies) measure the traffic.
NetFlow counts the packets as they arrive on an interface, not as they're sent out some other interface. This can lead to the effect you see. Imagine that you have a router with a fast (1 Gbps) LAN interface and slower T1's on the WAN side.
If a device on the local area side sends a burst of traffic to a device on the WAN side, NetFlow in the router detects that there were many packets that arrived on the LAN side. These packets will be buffered for (eventual) transmission out the slower WAN circuits.
Note that the LAN traffic cannot exceed the WAN link speed over the long term, but that bursts could show these kinds of spikes.
