Intermittent jitter issues with voice and video can be one of the more challenging IT issues to troubleshoot. Since traditional NetFlow  reporting does not include latency information, we are somewhat limited in NetFlow Analysis. None the less, we have to work with what we got!

One of the first things I do in our NetFlow collector is filter for the source and destination IP addresses participating in voice/video connection.  Then I start running reports.

One report I often run is the ‘Flows’ report which recently was renamed to “Grouped Flows”. Notice that all of the Flow Groups are marked either DSCP 0 or 34 (AF41, Assured Forwarding) :

NetFlow DSCP
NetFlow DSCP values

Since all of the traffic between these two hosts pertained to voice and video, I was a bit surprised to see some of the traffic marked as DSCP 0.  I ran a ToS report on the same filter and noticed that these are the only DSCP values being used in this video conference.

NetFlow ToS AF41 DSCP

I then looked at the flows in every step of the path to see if the DSCP values changed and they didn’t.  They were sourced with the wrong ToS value.  Why is the video application marking traffic this way? I can only speculate.  Remember, as a NetFlow Expert Tool, we point out the problem, then the talented engineer takes over.

Take a look at the nProbe if you want to measure and report on latency with NetFlow.

Mike Patterson author pic


Michael is one of the Co-founders and the former product manager for Scrutinizer. He enjoys many outdoor winter sports and often takes videos when he is snowmobiling, ice fishing or sledding with his kids. Cold weather and lots of snow make the best winters as far as he is concerned. Prior to starting Somix and Plixer, Mike worked in technical support at Cabletron Systems, acquired his Novell CNE and then moved to the training department for a few years. While in training he finished his Masters in Computer Information Systems from Southern New Hampshire University and then left technical training to pursue a new skill set in Professional Services. In 1998 he left the 'Tron' to start Somix which later became Plixer.


Big Data

Sankey Flow Graph

One of the greatest benefits of NetFlow collection for traffic analysis, is we’re provided with the ability to visualize the…

Leave a Reply