Question

I am collecting data from netflow using nfcapd. Also, we are monitoring all the devices for In traffic and Out traffic.

I am confused as in which data is sent to me by netflow.

For example,
In a 5 mins span, I receive netflow data which give sum(no_of_bytes) on a particular Link (srcip,dstip,srcifindex,dstifindex) = 10K Bytes.

While "In traffic" gives 20K Bytes and "Out Traffic" give 10K Bytes (approx).

What does this mean ?

My question is : The sum given by netflow data for a particular link should match with which Traffic on either port of the link ?

Was it helpful?

Solution

After google-ing some Cisco links, I found that Netflow only accounts for Ingress traffic. So the sum should be equal to out traffic.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top