How Flowmon Probe computes bytes
Information
| Summary: |
The article explains which ISO/OSI layers are included in the bytes flow field exported by Flowmon Probe. |
| Environment: |
Product: Flowmon Probe Version: Any Platform: Any |
| Question/Problem Description: |
Is the L2 header included in the bytes field exported by Flowmon Probe? |
| Steps to Reproduce: | |
| Error Message: | |
| Defect Number: | |
| Enhancement Number: | |
| Cause: | |
| Resolution: |
The flow exporter uses the IP header field "total length" to get information about the packet's byte count. This means that the L2 header and L2 FCS are not included in the bytes field (there can be a difference between flow monitoring and SNMP monitoring). Flow exporter covers only L3 traffic (ARP is the only exception), so L2 protocols such as LACP or STP are skipped. If any decapsulation is enabled (GRE, VxLAN,...), the tunnel protocol headers are not included in the bytes field (which also applies to the VLAN header). Only L3 total length inside tunneled traffic is included. |
| Workaround: | |
| Notes: |