On 4/12/10 7:39 PM, NReynolds wrote: > Quick question that came out of an issue we had last week. InterMapper > version 5.2.3, with one flows exporter, attached to our primary router in the > data center. The interface is an ethernet port, that has been set to 15 > Mbit, as that is the level of service from our MPLS provider. > > The issue is that when I look at the Flows data for that interface, when > network utilization was > 90% for more than 24 hours, the Flows window was > showing an average of 3000 KB/sec (23 Mbit ??). > The Flows window should be showing traffic in both directions, incoming and outgoing on the interface up to a total of 30 Mbit. The arrow controls in toolbar specify whether to track top senders/receivers or bidirectional. There are senders and receivers on both sides of the link.
There is no way in Flows to isolate just the tx or rx traffic on a particular interface. > I know that there is some error in flows data depending on when the sessions > ended, but both 15 minutes and 2 day graphs show traffic higher than should > be possible. I would guess that it's possible that we are getting 15 Mbit > both in and out of the interface, for a total of 30 Mbit, but I see peaks of > data over 5000 KB/sec (39 Mbit). Which doesn't make sense to me. > > I have access to another tool, Cacti, which shows the same interface, over > the same time frame, with an average of just over 14 Mbit utilization Both InterMapper and Cacti use ifInOctets and ifOutOctets to measure the average rate of traffic flowing over the link. This rate should be limited to 15 Mbit in each direction. Note that this is an average: if there are bursts of 100% that last a second or less, this will affect the average, but the average over the poll interval will remain less than 100%. NetFlow sessions are tracked individually using absolute timestamps. As a result, the Flow data should show you the actual bursts. Note that the Flow accounting takes place in the router *before* the traffic is transmitted on the link, so Flows may be counting traffic that the link was unable to send. Can you check to see if the peaks of data over 5000 KB/sec correlate with reports of tx discards on the interface in question? InterMapper will log interface discards automatically in the Event Log. -- Bill Fisher Dartware, LLC ____________________________________________________________________ List archives: http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ To unsubscribe: send email to: [email protected]
