We are behind in upgrading from version 5.4.X to Version 6.X. We currently have a FMC and sensor at version 6.4.0.1. Doing a side-by-side comparison from version 5.4.x, we see big differences in event generated. The sensors both monitor data from the same tap so the traffic should be the same. On the version 5.4.X we generate lets say 100 events for a SID. On the version 6.4.x side we are only seeing 20 events for the same SID and time frame. I have double checked and I don't see anything different in the policies and we do not have "Global Thresholding" enabled.
Any Ideas what will cause this big difference?
