Calculation of values in the TOP statistics

Calculation of values total flows, bytes and packets in TOP statistics is different depending on type of TOP statistics.

Output bytes and packets can be also different if you enable counter of these values.

Product: Flowmon OS

Version: Any

Platform: Any

Why sum of values in TOP statistics does not match with total values flows, bytes and packets?

TOP statistics based on the parameter
output are flows that contain given parameter and the number of flows, bytes and packets is value for the all flows in given interval.
TOP statistics based on any IP address
the address can be included in the flows twice – as source and destination. Also you can see message after analyse is processed – Due to current filter settings, some traffic is counted in more than one table row. That is why the total percentage is greater than 100%.

TOP statistics with used filter
If filter is used for the TOP statistics, sum of values only applies to the used filter.

TOP statistics based on IP conversations
Input and output bytes are aggregated, so there is only column Bytes for this statistic.

If the flow source also generates output bytes and output packets value, the Collector will include them if in Netflow V9 Fields Counter of output packets and Counter of output bytes is enabled (Configuration Center -> FMC Configuration -> Flow Database Fields -> NETFLOW V9 FIELDS).

Most flow sources like Flowmon Probe do not distinguish between input and output bytes and generate flows only as input bytes. Therefore display of output bytes in TOP statiscs is not possible by design.