Testing Scrutinizer to use Netflow to determine top talkers. Looking at Host to Host traffic on interface. Old system of using SPAN sport for top talker is showing 200 MB for last 5 minute top talker. Scrutinzer lists the same source/destination for top talker but lists total bandwidth at 1.09 GB for last 5 minutes.

Looking for help understanding the difference in bandwidth reporting. Testing for file copy, confirms the SPAN port is reporting the correct bandwidth usages and Scrutinzer is reporting much higher bandwidth usage than appears to be actually sent in 5 minutes.

Are you sure it's 1.09GB or not 1.09Gb?

You mention you're using a SPAN port, what are you exporting with? nProbe? Can you attached a screen shot?

- Tom

Two attached files show the two programs (Scrutinizer for netflow and PRTG running packet sniffer on a SPAN port). We copied a 118MB file. PRTG showed 5 minute traffic as 128MB and Scrutinzer reported 1.08GB.

Router config
sh ip flow interface

FastEthernet0/0

ip route-cache flow

FastEthernet0/0.10

ip flow ingress

FastEthernet0/0.19

ip flow ingress

ATM1/0.44

ip flow ingress

ATM1/0.777

ip flow ingress

It looks as if you are viewing in bits (b) rather than bytes(B) in Scrutinizer.
If you change the view from Percent, to Bytes in the configuration for this view, it should match what you are expecting.

The screen shot shows 1.08Gb which equals 126MB.
It's still a bit off, but it is much closer.

I am sure we could figure out what the difference is if we looked a little further.

Hey there,

2 things:

1. The traffic is actually the same, just specified differently. In figure 1 below, it's show the traffic in Mega Bytes (MB) while figure 2 is showing the traffic in Gigabit (Gb). As there are 8 bits in a byte, if you divide 1.08Gb by 8bits, you arrive at 135000000 bytes, which equates to roughly 128.75 MB.

2. Figure 2 is a report of host to host traffic. It's possible that if you don't have a port filter in your report that you may see additional traffic between those 2 hosts that would not be reflected in the report from figure 1.

I hope this helps clear up an discrepancies.

Sincerely,
Tom

what are you receiving the flows from? if it is a netflow probe like nprobe, it identifies all data as inbound. so it displays all in and out as 'in'. Also, are sure that you aren't displaying data in MB in stead of Mb?

We compare Scrutinizer NetFlow trends to SNMP trends before every release. We pay very close attention to in/out data points. My guess is that there is something wrong with the configuration and we need to identify it. perhaps it is time for a technical support conference all?"

Totally missed the Bits verses Bytes. We're all set now.