How to calculate flows per minute and flows per second

How to get the most out of your CySight software.

How to calculate flows per minute and flows per second

There are a number of methods to understanding flows per minute on your site with CySight installed and collecting flows. The fastest method is to analyze Flows using the Device Group Multiview.

Clicking on Multiview - Device Group will display a report showing all Device Groups by Bytes and Flows for the last 15 Minutes.

Image

Open the "Device Group (Flows/minute) Sub Reports Configuration options by clicking on the double arrow to the right of the date.

Change the Chart Type to Stacked Area Chart and click Redo. This makes it easy to see the aggregate of the flows if more than one Device Group.

Image

Change the Period of the Report to the last 1 to 3 days or to a period which will include peak periods. For some environments which have periodic data you may need to extrapolate or test during peak terms.

After changing the period change the display from Default to Minute.

Image

The Report will begin to perform an analysis.

Image

The scale will automatically display as flows, kilo-flows, mega-flows and giga-flows. Simply multiply the result by the appropriate power of 1000 to achieve the flows per minute result.

1 flow = 1 flow
1 k.flow = 1000 flows
1 m.flow = 1000000 flows
1 g.flow = 1000000000 flows

If you wish to see data in flows then you can change the Data Scaling Option to force a flows result.

Image
It is simplistic to divide flows per minute by 60 to achieve flows per second.

A division by 60 will result in a sustained flows per second statistic which is a theoretical number only.

Because traffic is dynamic and bursty by nature we have found a more realistic and useful rule of thumb is to multiply flows per minute by between 25%-50% to reveal a bursty flow per second result. The exact percentage can vary in different architectures and industries and will depend on the variance of the flow. Eg Campus environments will have a higher flow variance than a government infrastructure.

CySight is the only product that can effectively handle Bursty flows whilst retaining a superior level of data granularity.
The Report will display the Maximum and Average Flows per minute for all periods data was active for the query.
Loss can impact results. Data Collection Tuning can display loss statistics for Cisco NetFlow and other flow versions that support sequential flow numbering. IPFIX and jflow are known to not support flow sequencing correctly and currently cause CySight to display an incorrect loss statistic. Please email us for assistance if you suspect loss and are using a non Cisco export. Our trained eye can identify if loss is true or not!