I was told the conversations may not include all conversations, and the value will be read at a different point in time. Also, the whole issue of identified vs. unidentified applications needs to be factored into the calculation.
For example, let’s say that I collect conversation data for all of my TCP applications, ftp, http etc. I add these conversations up, and compare the totals to TCP. I am going to be way short, because there is lots of TCP traffic that is not being classified. Depending on how you have things set up, this unidentified TCP traffic can be seen in the TCP~ category. So now I add up all of the defined TCP apps stats, and the TCP~ apps stats. It still will not exactly match the total TCP traffic, because I will poll the mibs at a different point in time.
The other thing is that the trend reporter application drops conversations below a certain threshold by default.
Hope this helps.
