I am running an NM_NAM at a client site. I am using the NAM to monitor traffic on a 3825 router. The 3825 router is used to connect us to a WAN. The WAN interface is a Multipoint interface which is effectively two T1's bundled together to give us 3 MG bandwidth.
The 3 MG circuit is an MPLS circuit. We have specific traffic classes within the circuit.
I built a profile to monitor traffic statistics for the Class of Service. When I select the specific class of service for monitoring, and then select "Real-Time", it gives us a very easy to read graph which shows on a 4 minute line how many bits per second are in use in the class.
The question at hand is this: Where does the NAM read the data from? We know it is off of the Multilink because that was configured as the "Internal" interface of the NAM when we configured it a year ago. But where on the serial interface does it see the tag and at what point?
The dilema we are faced with here is that we also use Solarwinds Orion to monitor the interface and have Netflow reporting back to it. What we see on the NAM under real time monitoring on the class does not match what we see when we pull up Solarwinds Orion; it is actually quite a variance there. We are trying to figure out why.
I am attaching some snapshots of both the NAM reading as well as the Solarwinds Orion reading.
Here is the sample from the NAM. It shows an average of about 80K for Class of Service 2.
Here is the snapshot from Solarwinds for Class of Service 2 which is represented in green. It seems to show the bandwidth for CoS 2 at about 380K.