I just set up Netflow Analyzer to capture data from our Juniper SRX firewall. I used the recommended settings for Jflow (with some modifications due to code differences) from the documentation but it appears to be off by a factor of 10. For example, Netflow is reporting traffic rates between 50-100Mbps:
https://i.imgur.com/qTQU5CS.png. However, this interface is only connected to a 10Mbps internet circuit. Here are the traffic graphs from the device itself:
https://i.imgur.com/UQASw7j.png.
Here's the relevant config from the Juniper:
- sampling {
- input {
- rate 100;
- run-length 9;
- max-packets-per-second 7000;
- }
- family inet {
- output {
- flow-server 172.16.0.68 {
- port 9996;
- no-local-dump;
- source-address 172.16.1.16;
- version 5;
- }
- }
- }
- }
And here's the interface in Netflow Analyzer: http://i.imgur.com/hAkIW4c.png
What am I missing here? Thanks!