Intermittent jitter issues with voice and video can be one of the more challenging IT issues to troubleshoot. Since traditional NetFlow reporting does not include latency information, we are somewhat limited in NetFlow Analysis. None the less, we have to work with what we got!
One of the first things I do in our NetFlow collector is filter for the source and destination IP addresses participating in voice/video connection. Then I start running reports.
One report I often run is the ‘Flows’ report which recently was renamed to “Grouped Flows”. Notice that all of the Flow Groups are marked either DSCP 0 or 34 (AF41, Assured Forwarding) :
Since all of the traffic between these two hosts pertained to voice and video, I was a bit surprised to see some of the traffic marked as DSCP 0. I ran a ToS report on the same filter and noticed that these are the only DSCP values being used in this video conference.
I then looked at the flows in every step of the path to see if the DSCP values changed and they didn’t. They were sourced with the wrong ToS value. Why is the video application marking traffic this way? I can only speculate. Remember, as a NetFlow Expert Tool, we point out the problem, then the talented engineer takes over.
Take a look at the nProbe if you want to measure and report on latency with NetFlow.
