Netflow and SNMP measure two different things. SNMP measures layer2 traffic with precision, while netflow measures layer3 traffic (mostly IPv4) without precision. The precision loss is due to: * sampling (maybe it's off for you) * flow expire timers (a long-lasting flow - e.g. that lasts for hours, will only expire when it ends and you will see a spike corresponding to the whole session worth of data just in the end interval). On routers you can force expire long lasting flows (ideally every 5 minutes).
So it's normal to see less netflow traffic than SNMP. On Tue, Apr 21, 2020 at 5:12 AM Roberto Carna <robertocarn...@gmail.com> wrote: > Dear, I have nfsen installed in a Debian box. It works OK. > > I have an Internet link with an ISP which give me two public IP blocks. > > So I've created a nfsen profile in order to measure the Internet link > traffic, in this way: > > Traffic IN: DST NET <block_1> OR DST NET <block_2> > > Traffic OUT: SRC NET <block_1> OR SRC NET <block_2> > > But the resulting traffic curve is not the same to the SNMP curve obtained > with my SNMP monitor software. > > Please can you tell me what can be wrong? Is it possible to obtain similar > traffic curves using nfsen and snmp? > > Special thanks !!! > _______________________________________________ > Nfsen-discuss mailing list > Nfsen-discuss@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss >
_______________________________________________ Nfsen-discuss mailing list Nfsen-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
