I have been working for a year at a client whom has an NM_NAM installed on each 3800 router on opposite ends of an MPLS circuit. We have configured the NM-NAM to monitor traffic statistics in the Class of Service using Diffserv.
We use an AT&T MPLS circuit. The configuration is as follows: We do not use Class of Service 1. We use Class of Service 2 (af31) for our most important applicaiton. We use Class of Service 3 (af21) for most of our Windows user traffic. We then have the Default Class - Class 4 for the rest of the data. Bulk data applications typically reside here according to AT&T.
Back to the NAM. Our MPLS circuit is two T1's bundled together for a collective bandwidth of 3 MG. The issue is that when I display traffic statistics for each class of service in Real Time, it shows much more than 3 MG being used. It actually shows Default class running at 3 MG, and then 120K being used for Class 2.
Has anyone ever observed this behaviour before. What could be the issue with the display of the data not adding up to the avialable bandwidth. Why would it actually show that we are using more bandwidth than our capacity?
I haven't heard of any pervasive cases of such problems. Does "show policy" agree or disagree with what the NAM says? If you sniff some of this traffic in the NAM, do you see any duplicate packets?