How are NetFlow interface metrics calculated?
Overview
NetFlow monitoring provides granular insights into interface-level traffic using flow records exported from network devices. These records contain packet and byte counts, which are then used to obtain key metrics such as the traffic rate, volume, utilization, and packet rate. To reduce overhead, most devices apply sampling before exporting flows, and this impacts how traffic metrics are calculated. Here's how Site24x7 calculates each of these metrics using the received NetFlow data.
How Site24x7 calculates NetFlow metrics
Site24x7 calculates interface-level metrics using the flow data received from network devices. These calculations are directly influenced by the sampling rate configured on the exporting interface.
What is a sampling rate?
The sampling rate defines how many packets are observed versus how many are actually analyzed and exported as flow records. For example:
- A sampling rate of 10: Only one in every 10 packets is sampled.
- A sampling rate of 100: One in every 100 packets is sampled.
To estimate the actual traffic, Site24x7 multiplies the sampled data by the sampling rate.
Example
If a flow shows 1MB of sampled traffic and the sampling rate is set to 10, then the estimated total traffic is 1MB × 10 = 10MB.
This approximation helps provide accurate traffic statistics with a minimal impact on device performance.
A higher sampling rate configuration on the device can lead to inaccurate values on the dashboard.
Metrics calculation
Traffic
|
Metric
|
Description
|
Formula
|
|
In Traffic
|
The traffic received on the interface in bytes per second (Bps)
|
Inbound bytes × 8 / the time interval in seconds
|
|
Out Traffic
|
The traffic sent from the interface in Bps
|
Outbound bytes × 8 / the time interval in seconds
|
|
Total Traffic
|
The sum of in and out traffic in Bps
|
In Traffic + Out Traffic
|
Byte values are adjusted using the configured sampling rate:
Actual bytes = sampled bytes × the sampling rate
Volume
| Metric | Description | Formula |
| Rx Volume | The total volume received in bytes | Inbound bytes × the sampling rate |
| Tx Volume | The total volume transmitted in bytes | Outbound bytes × the sampling rate |
| Total Volume | The sum of the received and transmitted volumes in bytes | Rx Volume + Tx Volume |
Utilization (%)
|
Metric
|
Description
|
Formula
|
|
Rx Utilized
|
The interface input bandwidth usage as a percentage
|
(In Traffic / the interface speed in Bps) × 100
|
|
Tx Utilized
|
The interface output bandwidth usage as a percentage
|
(Out Traffic / the interface speed in Bps) × 100
|
The interface speed is retrieved via SNMP or the device configuration and is assumed to be constant for the calculation.
Packets
| Metric | Description | Formula |
| In Packets | The total number of packets received | The inbound packet count |
| Out Packets | The total number of packets sent | The outbound packet count |
| Total Packets | The sum of incoming and outgoing packets | In Packets + Out Packets |
Packet counts are sampled and scaled using the sampling rate.
Received Flows
| Metric | Description | Formula |
| Received Flows | The number of flow records received | The count of flows received by Site24x7's On-Premise Poller for the interface |
This metric reflects the number of flow records, not packets. Higher sampling or flow timeout values can impact this count.
Points to note
- Accuracy vs. performance:
- Full flow monitoring (1:1 sampling) captures every packet but can place a heavy load on the CPU and memory, especially on high-speed links.
- Choose a sampling rate that balances performance overhead and traffic visibility based on your environment.
- The sampling rate is device-configured:
- Site24x7 does not control the sampling rate. Ensure it's correctly configured on your router or switch that is exporting NetFlow records.
- Incorrect sampling settings may lead to inaccurate metrics:
- Always validate sampling configurations to ensure your traffic reports reflect the true network usage.
Related Articles
Response time in Website monitoring
In website monitoring, response time is calculated as the total time taken to resolve the DNS, complete the TCP hand-shake, negotiate an SSL handshake (for HTTPS) and download the full HTML output from the server. However, it does not include getting ...Troubleshoot the Error 404 and Error 99 for RabbitMQ
When installing the RabbitMQ plugin, you may encounter the following errors: HTTP Error 404: Not Found: This error usually occurs when Site24x7's RabbitMQ monitoring plugin attempts to access the /api/overview page of RabbitMQ, but the resource ...No data for service and process in Windows server monitor
If you see "No Data" for process and service metrics (such as CPU or memory usage of monitored services) in the Site24x7 Windows server monitor user interface, follow the troubleshooting steps below. Run PowerShell Commands Open PowerShell as ...Difference between a website monitor and a SOAP Web Service monitor
Website monitor will support monitoring of any web application via POST, GET and HEAD methods of configuration. Learn more on the performance metrics provided for a website monitor. SOAP Web Service monitors , on the other hand, lets you to ...Site24x7 Real User Monitoring (RUM) - Data Collection
When you include Site24x7 RUM beacon script in your web pages, the following data is collected. All data that's being collected is in accordance with GDPR compliance. Performance details of web page load time - Metrics like response time of web page ...