| I do believe that is the total byte count for that flow which should be for the duration of the "cache-timeout" value. There are two timeout values, idle-timeout with a default of 5 seconds and an active-timeout with a default of 30 minutes. So you aren't seeing the total for the interface but the total for specific flows. The "show interface" command will show you bits/sec and packets/sec based on a 5 minute interface average which can be reduced with the "load-interval" command (30 - 600 seconds). I'm not sure how much extra processing this produces so I wouldn't change it to an extremely low value for too long. |
| reply to shinotaku
Jmillermo is right. In more detail, you can have many entires per ip address ,for example if someone is filesharing. As he said each value is just data for that given flow. If someone is downloading a single 1gb file for example, that may show up as a single flow in top-talkers. If someone is doing bittorrent, that would show up as many smaller flows and may only reach a small amount of data per flow. |
