Question about stats

Hello all,

I am new here, but since I do a lot of traffic analysis, l I figured I would join and ask some questions.

When I look at the statistics in Netflow, I have issues making some sense out of it. For example, when I do an hourly report on a T1 interface for a remote site, I have 80% of total traffic being WEB, IN. I find this by looking at the application TAB. HTP is the top INCOMING application utilizing the interface.

But when I go to the NBAR tab to see the NBAR results, it shows that htp is only 11% with only 27.7 KB, IN.

Note that these results are pulled from the same timeframe.

Also when I do an NBAR report on traffic incoming on this interface, it shows EIGRP being the top.

So why the inconsistency? Why does the application tab show so much HTP IN, and the NBAR shows something completely different?

Thanks for any clarification.

BTW I think I had to use HTP instead of ht-t-p because of some SPAM thing. It wouldn't let me post.