How are NetFlow interface metrics calculated?
Overview
NetFlow monitoring provides granular insights into interface-level traffic using flow records exported from network devices. These records contain packet and byte counts, which are then used to obtain key metrics such as the traffic rate, volume, utilization, and packet rate. To reduce overhead, most devices apply sampling before exporting flows, and this impacts how traffic metrics are calculated. Here's how Site24x7 calculates each of these metrics using the received NetFlow data.
How Site24x7 calculates NetFlow metrics
Site24x7 calculates interface-level metrics using the flow data received from network devices. These calculations are directly influenced by the sampling rate configured on the exporting interface.
What is a sampling rate?
The sampling rate defines how many packets are observed versus how many are actually analyzed and exported as flow records. For example:
- A sampling rate of 10: Only one in every 10 packets is sampled.
- A sampling rate of 100: One in every 100 packets is sampled.
To estimate the actual traffic, Site24x7 multiplies the sampled data by the sampling rate.
Example
If a flow shows 1MB of sampled traffic and the sampling rate is set to 10, then the estimated total traffic is 1MB × 10 = 10MB.
This approximation helps provide accurate traffic statistics with a minimal impact on device performance.
A higher sampling rate configuration on the device can lead to inaccurate values on the dashboard.
Metrics calculation
Traffic
|
Metric
|
Description
|
Formula
|
|
In Traffic
|
The traffic received on the interface in bytes per second (Bps)
|
Inbound bytes × 8 / the time interval in seconds
|
|
Out Traffic
|
The traffic sent from the interface in Bps
|
Outbound bytes × 8 / the time interval in seconds
|
|
Total Traffic
|
The sum of in and out traffic in Bps
|
In Traffic + Out Traffic
|
Byte values are adjusted using the configured sampling rate:
Actual bytes = sampled bytes × the sampling rate
Volume
| Metric | Description | Formula |
| Rx Volume | The total volume received in bytes | Inbound bytes × the sampling rate |
| Tx Volume | The total volume transmitted in bytes | Outbound bytes × the sampling rate |
| Total Volume | The sum of the received and transmitted volumes in bytes | Rx Volume + Tx Volume |
Utilization (%)
|
Metric
|
Description
|
Formula
|
|
Rx Utilized
|
The interface input bandwidth usage as a percentage
|
(In Traffic / the interface speed in Bps) × 100
|
|
Tx Utilized
|
The interface output bandwidth usage as a percentage
|
(Out Traffic / the interface speed in Bps) × 100
|
The interface speed is retrieved via SNMP or the device configuration and is assumed to be constant for the calculation.
Packets
| Metric | Description | Formula |
| In Packets | The total number of packets received | The inbound packet count |
| Out Packets | The total number of packets sent | The outbound packet count |
| Total Packets | The sum of incoming and outgoing packets | In Packets + Out Packets |
Packet counts are sampled and scaled using the sampling rate.
Received Flows
| Metric | Description | Formula |
| Received Flows | The number of flow records received | The count of flows received by Site24x7's On-Premise Poller for the interface |
This metric reflects the number of flow records, not packets. Higher sampling or flow timeout values can impact this count.
Points to note
- Accuracy vs. performance:
- Full flow monitoring (1:1 sampling) captures every packet but can place a heavy load on the CPU and memory, especially on high-speed links.
- Choose a sampling rate that balances performance overhead and traffic visibility based on your environment.
- The sampling rate is device-configured:
- Site24x7 does not control the sampling rate. Ensure it's correctly configured on your router or switch that is exporting NetFlow records.
- Incorrect sampling settings may lead to inaccurate metrics:
- Always validate sampling configurations to ensure your traffic reports reflect the true network usage.
Related Articles
How to set up alerts for network device data collection issues
When your network monitoring interfaces are not collecting data due to issues in the Network Module, you'll want to be alerted. To set up alerts, you need to add or edit the threshold and availability profile of the On-Premise Poller, which is used ...How is the basic and advanced monitor count calculated in the Site24x7 web client?
Site24x7 licensing and pricing works based on the type of monitor. Monitors are classified as basic and advanced monitors. The Super Admins can view a detailed breakdown of license usage with License Usage Summary. The monitors in your Site24x7 ...Response time in Website monitoring
In website monitoring, response time is calculated as the total time taken to resolve the DNS, complete the TCP hand-shake, negotiate an SSL handshake (for HTTPS) and download the full HTML output from the server. However, it does not include getting ...Understanding data retention in Site24x7
Data retention refers to the practice of storing data for a specific period to meet operational, legal, or business needs. It ensures that important information is available for compliance, audits, security investigations, and historical analysis. ...How to calculate Mobile APM screen load times
Mobile APM provides load time metrics to help you understand how long it takes for your mobile app screens to load. These load times are calculated by capturing start and end timestamps during specific lifecycle callbacks. Load times for native ...