*ugh* I really, really need a vacation! I could have sworn the netflow side was set to bytes, but it wasn't... that was the difference. Thanks! Sorry... a little brain damage on my part...
Steve Pfister Technical Coordinator, The Office of Information Technology Dayton Public Schools 115 S. Ludlow St. Dayton, OH 45402 Office (937) 542-3149 Cell (937) 673-6779 Direct Connect: 137*131747*8 Email [email protected] >>> Gerry Boudreaux <[email protected]> 12/17/2009 2:46 PM >>> is one reporting bits and the other bytes? (Factor of 8) On Dec 17, 2009, at 12:41 PM, Steven Pfister wrote: > I'm trying to diagnose some bandwidth problems at one particular remote site. > At the moment, I'm concentrating on one particular server (a Novell site > server, looking at NCP packets...tcp port 524 outbound from that server to > addresses outside of that remote site). > > I turned on ip accounting for that server's address and let it run for about > an hour and a half. I also had NetFlow enabled and exporting flows and > checked the same interface ip accounting is running on. When I look at the > top 10 conversations for both, I'm noticing something I don't understand. The > destinations on both sides are pretty much the same, but each conversation on > the netflow side is larger by a factor of roughly 8-10x than the > corresponding conversation on the ip accounting side. > > I've also done a packet capture with wireshark on a previous day for the same > sort of traffic for the same server and interface. The size of the data was > more similar to the ip accounting results. I'm wondering if I've > misconfigured something on the NetFlow side. Can someone help me figure out > what might be going on here? > > > Steve Pfister > Technical Coordinator, > The Office of Information Technology > Dayton Public Schools > 115 S. Ludlow St. > Dayton, OH 45402 > > Office (937) 542-3149 > Cell (937) 673-6779 > Direct Connect: 137*131747*8 > Email [email protected] > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
