My company has a Cisco ASR 1001 Router that is sending netflow data to a cisco prime infrastructure installation and to a riverbed steelcentral collector (appresponse). There exists a rather large discrepancy between what the two platforms show as far as traffic breakdowns, where the riverbed appliance shows what I expect to see and the prime appliance shows the application numbers as being wrong by a factor of 10 or more. The below two screen snips were taken within 30 seconds of each other.
There is no way that this router is pumping ~300Mbps of traffic that is just VPN_AnyC (custom group to match traffic to our VPN server). I get the impression that Prime is double counting this some how but am not sure why or how.
The below image shows the actual TX and RX rates, which I can verify as being correct. The total link speed is 700Mbps for context. The numbers from the above app category tally up to more than 700Mbps, which is clearly wrong in my eyes.
Is this something I should open a TAC case for or are there any known fixes for this issue?
