How are NetFlow interface metrics calculated?

How are NetFlow interface metrics calculated?

Overview

NetFlow monitoring provides granular insights into interface-level traffic using flow records exported from network devices. These records contain packet and byte counts, which are then used to obtain key metrics such as the traffic rate, volume, utilization, and packet rate. To reduce overhead, most devices apply sampling before exporting flows, and this impacts how traffic metrics are calculated. Here's how Site24x7 calculates each of these metrics using the received NetFlow data.

How Site24x7 calculates NetFlow metrics

Site24x7 calculates interface-level metrics using the flow data received from network devices. These calculations are directly influenced by the sampling rate configured on the exporting interface.

What is a sampling rate?

The sampling rate defines how many packets are observed versus how many are actually analyzed and exported as flow records. For example:
  1. A sampling rate of 10: Only one in every 10 packets is sampled.
  2. A sampling rate of 100: One in every 100 packets is sampled.
To estimate the actual traffic, Site24x7 multiplies the sampled data by the sampling rate.
Example
If a flow shows 1MB of sampled traffic and the sampling rate is set to 10, then the estimated total traffic is 1MB × 10 = 10MB.
This approximation helps provide accurate traffic statistics with a minimal impact on device performance.
Notes
A higher sampling rate configuration on the device can lead to inaccurate values on the dashboard.

Metrics calculation

Traffic

Metric
Description
Formula
In Traffic
The traffic received on the interface in bytes per second (Bps)
Inbound bytes × 8 / the time interval in seconds
Out Traffic
The traffic sent from the interface in Bps
Outbound bytes × 8 / the time interval in seconds
Total Traffic
The sum of in and out traffic in Bps
In Traffic + Out Traffic
Notes
Byte values are adjusted using the configured sampling rate:
Actual bytes = sampled bytes × the sampling rate

Volume 

Metric Description Formula
Rx Volume The total volume received in bytes Inbound bytes × the sampling rate
Tx Volume The total volume transmitted in bytes Outbound bytes × the sampling rate
Total Volume The sum of the received and transmitted volumes in bytes Rx Volume + Tx Volume

Utilization (%)

Metric
Description
Formula
Rx Utilized
The interface input bandwidth usage as a percentage
(In Traffic / the interface speed in Bps) × 100
Tx Utilized
The interface output bandwidth usage as a percentage
(Out Traffic / the interface speed in Bps) × 100
The interface speed is retrieved via SNMP or the device configuration and is assumed to be constant for the calculation.

Packets 

Metric Description Formula
In Packets The total number of packets received The inbound packet count 
Out Packets The total number of packets sent The outbound packet count 
Total Packets The sum of incoming and outgoing packets In Packets + Out Packets
Packet counts are sampled and scaled using the sampling rate.

Received Flows

Metric Description Formula
Received Flows The number of flow records received The count of flows received by Site24x7's On-Premise Poller for the interface
This metric reflects the number of flow records, not packets. Higher sampling or flow timeout values can impact this count.

Points to note

  1. Accuracy vs. performance:
    1. Full flow monitoring (1:1 sampling) captures every packet but can place a heavy load on the CPU and memory, especially on high-speed links.
    2. Choose a sampling rate that balances performance overhead and traffic visibility based on your environment.
  2. The sampling rate is device-configured:
    1. Site24x7 does not control the sampling rate. Ensure it's correctly configured on your router or switch that is exporting NetFlow records.
  3. Incorrect sampling settings may lead to inaccurate metrics:
    1. Always validate sampling configurations to ensure your traffic reports reflect the true network usage.

    • Related Articles

    • How are network interface metrics calculated using SNMP?

      Interface reports provide visibility into the performance and health of network interfaces. These reports use SNMP data collected at intervals to compute key metrics that help monitor traffic flow, detect anomalies, and optimize bandwidth usage. ...

    • Understanding CloudWatch metrics cost calculation for AWS services

      This document explains how the cost of CloudWatch metrics is calculated in AWS when retrieving data at a five-minute interval for multiple metrics over a month. Step-by-step cost calculation 1. Requests per metric When retrieving a metric at a ...

    • How can I ensure that the correct interface names are shown for a NetFlow monitor?

      To ensure that Site24x7 can query and display the correct interface names for your NetFlow monitor, you need to provide the right SNMP credentials (i.e., username, password, and community string) with the appropriate access levels. SNMP is the ...

    • Verifying the NetFlow port of an On-Premise Poller

      For NetFlow analysis, you need to configure your devices to export flows to Site24x7 On-Premise Poller, which is the NetFlow collector. The On-Premise Poller will be listening to the particular port to receive flows, which is why a proper port number ...

    • Understanding VMware VM and guest OS metrics

      Log in to your Site24x7 account, and navigate to VMware > Virtual Machine. Click on any desired VM name. Metrics from the VM monitor The metrics that you view are your VM's occupancy in its parent ESX host. Using Memory Utilization as an example, the ...