Netflow Bandwidth Usage Incorrect
Hello,
We are in the process of trying to configure opmanager for use in our enterprise however it has come to my attention that the bandwidth usage showing up in the netflow system is wrong. Over the last while we have had some very large 4.29GB sessions recorded for protocols and links that could not possibly be using that much data.
I took it upon myself to run some sample transfers through the ASA 5510 reporting at the moment. An exact 500MB rar file being sent outside via ftp to a public web server showed up at 958.62 MB in the last hour report(transfer took 18~minutes and was during that hour).
Now looking at the last 6 hour report the same transfer shows as 692.98 MB.
A few hours later I was curious how accurate those numbers were even so I decided to transfer the 500MB file inbound from the web. The last hour reports it as 235.1 MB.
Just today I was manually monitoring bandwidth on the ASA we have reporting as well as the Symantec server. I was able to see a vpn users connection at around ~300 MB when he disconnected. The users ip was recorded as transfering 4.29 GB of SEP traffic over port 8014. Checking the apache logs on the Symantec server the transfer did not finish (full definition update over 8014 would have been about 150MB).
We are in the process of trying to configure opmanager for use in our enterprise however it has come to my attention that the bandwidth usage showing up in the netflow system is wrong. Over the last while we have had some very large 4.29GB sessions recorded for protocols and links that could not possibly be using that much data.
I took it upon myself to run some sample transfers through the ASA 5510 reporting at the moment. An exact 500MB rar file being sent outside via ftp to a public web server showed up at 958.62 MB in the last hour report(transfer took 18~minutes and was during that hour).
Now looking at the last 6 hour report the same transfer shows as 692.98 MB.
A few hours later I was curious how accurate those numbers were even so I decided to transfer the 500MB file inbound from the web. The last hour reports it as 235.1 MB.
Just today I was manually monitoring bandwidth on the ASA we have reporting as well as the Symantec server. I was able to see a vpn users connection at around ~300 MB when he disconnected. The users ip was recorded as transfering 4.29 GB of SEP traffic over port 8014. Checking the apache logs on the Symantec server the transfer did not finish (full definition update over 8014 would have been about 150MB).
Currently we have zero confidence in opmanagers netflow as the number are not adding up. Any input is appreciated.