I just received an email from someone in Europe asking a question that I thought Riverbed and Scrutinizer NetFlow customers might be interested in.

I’ve just read the message you posted a few months ago concerning an overstating problem with the NetFlow feature on a Riverbed appliance. I’m currently working with NetFlow data sent by a Riverbed appliance, and I think that I have to deal with the same problem you encountered.  What do I do?

ANSWER: Yes, overstating utilization with the Riverbed gear is a problem using Cisco NetFlow v5 because outbound utilization is calculated using inbound traffic from the other interfaces. Because of this, compression that occurs is not considered and overstated utilization is the result.

I have escalated this issue to Riverbed and pointed out that the solution is to export Cisco NetFlow v9 with Egress flows.  NetFlow v5 only supports ingress flows. Although with the right configuration, Scrutinizer v6 supports Cisco NetFlow v9 with egress flows, we have made enhancements in Scrutinizer v7.  I have not heard anything from Riverbed regarding this issue and the need to support NetFlow v9, like the Cisco WAAS solution. I think we can be confident that that a company like Riverbed that is supporting some of the largest networks in the world must be thinking about NetFlow v9 with egress support.

NOTE: I believe Riverbed has a proprietary solution to this problem that you can buy. If you contact Riverbed and they share with you their plans, can you please  let me know?

Mike Patterson author pic


Michael is one of the Co-founders and the former product manager for Scrutinizer. He enjoys many outdoor winter sports and often takes videos when he is snowmobiling, ice fishing or sledding with his kids. Cold weather and lots of snow make the best winters as far as he is concerned. Prior to starting Somix and Plixer, Mike worked in technical support at Cabletron Systems, acquired his Novell CNE and then moved to the training department for a few years. While in training he finished his Masters in Computer Information Systems from Southern New Hampshire University and then left technical training to pursue a new skill set in Professional Services. In 1998 he left the 'Tron' to start Somix which later became Plixer.


Leave a Reply