Owners Manual

Traffic Flow Portlet | Traffic Flow Analyzer
538 OMNM 6.5.2 User Guide
- NetFlow V9 and IPFIX with a single sampling rate for the entire device. In these cases an
options datagram contains the sampling rate for the device.
- NetFlow V9 and IPFIX with a sampling rate specific to an interface. In these cases an
options datagram contains a sampling rate and a sampler ID. Flows then contain a sam-
pler ID to associate to this. When flows say the sampler ID is 0 then this feature is dis-
abled for this interface.
Estimated total bytes and packets are calculated by multiplying the reported sampled values
by the sampling rate. This works differently for sFlow and NetFlow. NetFlow packets contain
fields for the reported sampled bytes and packets. For example if the packet reports that the
sampled bytes is 45 and the sampling rate is 100 then the estimated total bytes will be 4500.
Likewise if the sampled packets is 3 then within this same example the estimated total
packets will be 300. sFlow packets do not contain fields for the sampled bytes or packets.
Instead, sFlow works by sampling packets that are going through the exporter, and attaching
these sampled packets to sFlow packets for export. So the reported sampled bytes is
computed by adding the total bytes of the sampled packet that is contained within the sFlow
packet and the reported sampled packets is naturally 1 for each sFlow packet that is exported.
The estimated total bytes and packets is computed by multiplying each of these numbers by
the sampling rate that is reported in the sFlow packet. For example, if the sampled bytes is 10
and the sampling rate is 512 then the estimated total bytes will be 5100 and likewise the
estimated total packets will be 512 since this is the sampling rate.
NOTE:
For devices that are not sampling traffic data (they are reporting on 100% of the traffic going through the
device), the estimated values will be the same as the raw values.
Select flow direction — Lets you change the flow direction of the data that is queried. The options
are Ingress, Egress, and Both Ingress and Egress, which is the default. This notion is related to
the way in which the traffic is handled by the exporter and how the exporter was configured at
the subcomponent (port or interface) level. When a flow goes through a device, it must go
into some subcomponent (ingress) and also out some subcomponent (egress). In some cases
only ingress flows are reported on by the exporter and in some cases only egress flows are
reported. Sometimes both ingress and egress are reported, but the byte and bits/second values
might be affected by whether the flow is ingress or egress, as reported by the exporter. In
some cases these values can have different data compression rates and thus it would be
misleading to count them together. Also sometimes you need to know how much data is
going into our out of a port or interface. This option allows you to sort this out by focusing
only on ingress or egress if you need to do so.
Traffic Flow Snapshots — Load or save a snapshot (preserved views) of traffic flow.
Export Data —Lets you export the data in the current view to a file. You can either save the
current view to a PDF file or export the data to a CSV file. If you select Export to PDF, the
resulting file will show a screen shot of the graph and the chart as shown on the screen. If you
select Export to CSV, the resulting file will contain the data points for the time-slice data in
the graph shown on the screen. The exception to this is if you are viewing a pie chart - in