Kemp Support, how can we help?

The latest application delivery knowledge and expertise at your fingertips.

  1. Kemp Support
  2. Knowledge Base
  3. Flowmon General
  4. Flowmon OS

Traffic duplicity

Updated: 

 

Information

 

Summary:

Possible causes of flow duplicity in the case of 3rd party flow source devices and how to filter duplicity if flow source configuration cannot be changed.
Environment:

Product: Flowmon

Version: Any

Platform: Any
Question/Problem Description:

Why do we see traffic duplicity in the analysis result? Why is the traffic bandwidth 2x greater than expected?
Steps to Reproduce:  
Error Message:  
Defect Number:  
Enhancement Number:  
Cause:

Wrong flow interface or flow exporter configuration.
1. Flow export is configured for multiple interfaces and all interfaces are set as input and output.
In this case, captured flows have e.g. values:
1st flow – Input interface: Gi0/0/1 Output Interface Gi0/0/2

2nd flow – Input interface: Gi0/0/2 Output Interface Gi0/0/1

The amount of traffic is aggregated for each interface, because is figuring for both flows, regardless of whether it appears as input or output. For channel sources is automatically applied filter if <x>.

2. Same traffic is captured as ingress and egress 
Resolution: 1. In case of monitoring multiple flow interfaces set all of them as input, or create a profile with channel filter to see only input traffic for the interface:
in if <x>
2. Create profile with channel filter:
(in if <x>) and (flowdir I)
Workaround:  
Notes:

Ideas:
https://flowmon.ideas.aha.io/ideas/NPMD-I-106
https://flowmon.ideas.aha.io/ideas/NPMD-I-154
Was this article helpful?
0 out of 0 found this helpful

Comments

In this document