문제

I am collecting data from netflow using nfcapd. Also, we are monitoring all the devices for In traffic and Out traffic.

I am confused as in which data is sent to me by netflow.

For example,
In a 5 mins span, I receive netflow data which give sum(no_of_bytes) on a particular Link (srcip,dstip,srcifindex,dstifindex) = 10K Bytes.

While "In traffic" gives 20K Bytes and "Out Traffic" give 10K Bytes (approx).

What does this mean ?

My question is : The sum given by netflow data for a particular link should match with which Traffic on either port of the link ?

도움이 되었습니까?

해결책

After google-ing some Cisco links, I found that Netflow only accounts for Ingress traffic. So the sum should be equal to out traffic.

라이센스 : CC-BY-SA ~와 함께 속성
제휴하지 않습니다 StackOverflow
scroll top