By default, FastNetMon Advanced uses exponential moving average algorithm to calculate bandwidth. In some cases, when routers send traffic telemetry in bursts or a stream of telemetry is not even, it may not provide the best accuracy, and you may notice 20-30% deviation from real traffic.
Usually, it happens only with Netflow / IPFIX-based protocols. The best option to address it is to move to sFlow or PSAMP-based protocols if they’re supported by equipment, as these protocols provide way better bandwidth calculation accuracy.
In this case, you may switch FastNetMon to simple average calculation mode this way:
sudo fcli set main speed_calculation_delay 45 sudo fcli set main average_calculation_time 1 sudo fcli commit
In this mode, FastNetMon does not use any complicated algorithms, which may be vulnerable to anomalies in telemetry export logic to calculate bandwidth and just calculates traffic every speed_calculation_delay seconds. Unfortunately, attack detection will be delayed by the value set in speed_calculation_delay.
For Netflow / IPFIX-based algorithms, speed_calculation_delay should exceed both active and inactive flow timeouts.
All dashboards and traffic calculation metrics from fcli and API will be re-calculated once per speed_calculation_delay seconds.