Nominated Discussion: Understanding Network Throughput Graphs

This Nominated Discussion Article is based on the post "Network Throughput Graphs are incoherent in PA-220" by @AlanDeBoer and responded to by @aleksandar.astardzhiev . Read on to see the solution!

Hi,

We are experiencing an issue with the PA-220 network graphs displayed in one of our sites.

We know that the router in front of the firewall delivers a 90 Mbps (Megabit per second) max throughput. This measure has been verified extensively.

However when trying to visualize the traffic received by our test machine from the firewall web GUI, we notice some extremely high values in the hundreds of MegaBytes.

This test machine is connected to the PA through a single NIC card, and the test consisted in a standard online bandwidth test service.

For instance at 15:00, according to the graph below our machine would have received roughly 550 MBytes of data in 1 second? That's just impossible ...

How am I supposed to read this graph and could there be an issue with the scale?

This is the Network Monitor graph for the test machine : ( TBN that we get similar values when using the Ingress/Egress Interface Widget Graph from the ACC and filter using the same IP)

As a side comparison when we extract the bitrate graph associated with the interface used for internet communication on this firewall, from the Panorama we get something that is much more coherent :

Here we get a max throughput of roughly 9 MBytes which translates to 72 Mbps, it makes sense.

Any help on this matter would be greatly appreciated!

Thanks,

The Network Monitor graph time scale - it is one hour. This graph doesn't present throughput, but rather accumulated volume of data for one hour related to this address. This should include downloaded and uploaded data for one hour.

So the proper way to read the graph is - "550MByes of data for 1hour"

You may found the following useful for determining the current throughput:

Graphic Traffic Monitoring for Interfaces - QoS Statistics - Knowledge Base - Palo Alto Networks

How to Check Throughput of Interfaces - Knowledge Base - Palo Alto Networks