Comparing NetFlow and SNMP data

Products

• CA Infrastructure Performance
• CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

There is a difference between reports which use SNMP and CA Network Flow Analysis (ReportAnalyzer) data. Why is there such a difference?

 

Environment

All NFA and RA Versions

Cause

Difference between SNMP data and Netflow 

Resolution

First of all, make sure that the NetFlow configuration is done properly on the router.

=> If NetFlow version 9 is used, then egress and ingress should be enabled on required interfaces

=> If NetFlow version 5 is used, then either ingress should be enabled on all the active interfaces.

Though the NetFlow configuration is correct, NetFlow and SNMP are fundamentally distinct technologies and therefore both may not report the exact same traffic out of a given interface.

When comparing NetFlow and SNMP-based data, the following should be considered:

• NetFlow will not report non-IP traffic;
• NetFlow will not report multicast IP traffic;
• A busy router sometimes can't keep up with flow exports, look out for dropped flow packets in the router;
  • What do the NetFlow Missed Flow Sequence Numbers look like?
• If looking at outbound utilization, please ensure that NetFlow is enabled on ALL interfaces as in NetFlow 5, Outbound is determined using inbound flows.
• Not all hosts, conversations, protocols, etc are displayed in the graphs (not even as part of the 'Other' group).  This is explained in the documentation here:
  https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/network-flow-analysis/21-2/managing/maintenance-and-data-collection/data-collection/15-minute-data.html