Hi Jason,
What I can the tell you about that problem is the following.
ntopng in collector mode can only guess traffic rate from the flows it
receives from nProbe. If nProbe exports a lot of flows at once, ntopng
will consider that traffic as appearing all together, resulting into an
higher
We've a mikrotik sending to nprobe and then on to ntopng.
The flow timeout on the mikrotik is set to 1minute which is the same on nprobe,
but we're consistently seeing the traffic as showing a higher level than the
maximum interface speed. i.e. we're seeing ~320Mbps reported on an interface
