Re: Combining subnet statistics
Simone Mainardi <[email protected]>
| Newsgroups | gmane.linux.ntop.general |
|---|---|
| Message-ID | <[email protected]> |
Peter, > On 13 Feb 2018, at 22:49, Peter Shute <[email protected]> wrote: > > Simone Mainardi wrote: > >>> I have this running now, so I can't try creating host pools unless I undo >> those changes. >>> >>> One thing I've noticed with dynamic interfaces is that if I select one, then >> click on the chart icon, the traffic peaks seem way too high. Eg 85Mbps when >> we only have a 14Mbps link. >> >> Peaks you are seeing are very likely due to the quantized nature of flows. >> Your netflow exporters do periodic exports of active flows -- say every 2 >> minutes -- so the ntopng/nProbe pair is not able to know what happened >> during the 2 minutes, it just receives the exported flow at the end of the >> period. This translates into a potentially high volume of traffic in a very short >> period that determines the peak. However, total values over time must be >> consistent. > > That makes sense. I wonder if it would be helpful to add a note about that on the charts so that people understand their limitations. Correct, we will add it. > > Does this mean I can still use those charts to look for periods of high usage, but should take the vertical scale with a grain of salt? Correct. The interface chart with 1-second data points -- say the latest 10 minutes -- should be taken with a grain of salt on configurations that involve flows collection. Selecting wider time ranges will automatically average out short peaks and will provide you more accurate information. > > Peter Shute > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop