[c-nsp] Netflow reported utilization vs actual

[Mark Borchers]

> -----Original Message-----
> 
> 	Hi, folks. Should the reported utilization from netflow 
> flows be the
> actual utilization on the interface? I have a 2620 exporting to Fedora
> running flow-tools and CUGrapher, yet I notice that the aggregate
> utilization reported is lower than reported from MRTG via SNMP. All up
> interfaces excluding the Lo0 have been enabled for netflow...
> 
> 	Any ideas?
> 
> Rick Cheung


I am also interested in seeing a rigorous answer to that
question.  It makes sense to me that the total flow volume
would be less than aggregate measurements due to:
1) Layer 2 overhead being ignored since netflow works at layer 3
2) Retransmitted traffic not showing up in netflow stats (?)

However, the gap between flow volume and aggregate volume that
I have observed seems slightly larger than the above would
account for.