The NPM interface charts are showing less bandwidth utilization than the Netflow charts

This article describes an issue when NetFlow charts show less bandwidth utilization than NPM interface charts. 

This can be caused by device configuration or application setting being disabled.

Depending on the make and model of the device, it can make a difference on the troubleshooting steps to take.

1. Correctly identify the make and model of the device
   1. If the device is a Cisco 6500 series, device configuration is usually the problem with this device. The following command is usually missing ip flow ingress layer2-switched vlan xxxx which will cause switched layer 3 traffic not to be captured
   2. Compare your device configuration with the following topic: Netflow device examples .
2. If device is something other than Cisco 6500 proceed with the following steps:
   1. Verify the following command is configured: ip flow-cache timeout active 1

      This will ensure that all cached flow data is exported every 1 minute. By default long lived packets are exported every 30 minutes and could cause some spikes and a delay in data that will not show actual utilization during the same time as NPM.

   2. Check the NTA Settings page and see if the following settings are enabled or disabled Allow monitoring of flows from unmanaged interfaces and Enable Data retention for traffic on unmonitored ports . 
      • When these are disabled, they can cause flows to be dropped.
      • If both interfaces in the flow packet are not being managed in NPM when you disable the option Allow monitoring of flows from unmanaged interfaces  , the entire flow will be dropped.

      

   3. If packets are being dropped this can also be verified by checking the Netflow performance counters to see if the counters are increasing.

      

3. If all the steps mentioned above are completed correctly, perform a Wireshark capture and verify all required fields are properly populated.
4. NetFlow requires fields to gather full information. If some of the required fields are missing, the entire flow will be dropped.

   If interface index (ifIndex) values are zeros (0), data will not be captured in that direction. Also, if only ingress or egress data is provided, you will be missing data in the Ingress or Egress direction.

   • SNMP Input interface ifindex value
   • SNMP Output interface ifindex value
   • Ingress bytes
   • Ingress packets
   • Protocol
   • Source UDT/TCP ports
   • Destination UDT/TCP ports
   • Source IP Address
   • Destination IP Address
   • Optional are IP ToS and AS value