I am trailing NetFlow Analyser V 9.6 and I am getting strange results. I am using this with two fairly old HP Procurve 2824 switches.

I have created an IP group for an appliance which is used as a IPSEC VPN endpoint. Only the IP address of the appliance has been added.

The appliance itself reports we are using a maximum 30Mbps but netflow reports over 100Mbps

I have checked with our ISP bandwidth portal and they also report a maximum spike of just over 30Mbps

What could cause this?