By default, FastNetMon Advanced uses exponential moving average algorithm to calculate bandwidth. In some cases when routers send traffic telemetry in bursts or stream of telemetry is not even it may not provide best accuracy and you may noticed 20-30% inaccuracy with real traffic.
Usually, it happens only with Netflow / IPFIX based protocols. The best option to address it to move to sFlow or PSAMP based protocols if they’re supported by equipment as these protocols provide way better bandwidth calculation accuracy.
In this case you may switch FastNetMon to simple average calculation mode this way:
sudo fcli set main speed_calculation_delay 45 sudo fcli set main average_calculation_time 1 sudo fcli commit
In this mode FastNetMon does not use any complicated algorithms which may be vulnerable to anomalies in telemetry export logic to calculate bandwidth and just calculates traffic every speed_calculation_delay seconds. Unfortunately, attack detection will be delayed by value set in speed_calculation_delay.
For Netflow / IPFIX based algorithms speed_calculation_delay should exceed both active and inactive flow timeouts.
All dashboards and traffic calculation metrics from fcli and API will be re-calculated once per speed_calculation_delay seconds.