Just getting familiar with Netflow on ManageEngine. As well as trying to sell the purchase of it to Management.

I have 2 routers at the ends of a licensed wireless link. Speed differs greatly when I compare the interfaces at each end of this link using Netflow. When using SNMP with as low as 2 second polling the interfaces match 100% when using SNMP with 5 minute polling the interfaces match 100% as well.

I have setup netflow on these routers with 64k cache, 1 minute timeout on active flow, 15 second timeout on inactive flow, Version 9 Template refresh 20, Template timeout 60.

For example on a 1 hour time period Compare report for the 2 interfaces involved the max traffic now is shown as 54.34Mbps on router A and 67.65Mbps on router B. Router A is the source side of the traffic in question Router B is the destination. Why are these readings not much closer? I would expect some difference but a 13.31Mbps difference is outside the range of what I would expect. We lost 13.31Mbs in 60 minutes on one end or the other. Sender is lower than receiver so actual traffic loss is not the issue.

This all came up with trying to get some tool for assisting in capacity planning. The ManageEngine traffic reports differ by too much to be accurate in this area. SNMP on this link shows a maximum of 651.24Mb out of a max value of 700Mb over the air value. ManageEngine calculates that the link is 71.94% of a maximum of 700Mb so. 72% of 700 is 504 so I have a 147Mbit discrepancy over a 24 hour report. Not valuable for capacity planning when you can watch the interfaces go to 93% of 700Mb every day and both ends of the SNMP monitor are the same values for the most part. This link is at the point we need more bandwidth that is obvious. My point is why is there such a large difference in the numbers?

Thank You,

Jerry Allen