traffic report -> wrong byte counts ?

[rfle.rz]

Hello,

I recently created some scheduled custom report to list the top 25 byte-consumers for the last calender day.

This works well and provides a listing with source and dest zone, source and dest address and bytes.

But if I drill down, there is a massive discrepance between the amout that is displayed in the report ( e.g. 31,833,534,225 bytes )

and the detail-page for the same time-period, where only about 355 MBs are listed for the correspondinc address-pair.

This lower value corresponds to Netflow data, we are capturing.

The behaviour is the same if I run the report on demand and / or for different time periods

We are running a PAN-500 as a  Virtual Wire between netword and squid-proxy

any ideas ?

Kind Regards

Franz Leippert

[odaos]

You might want to check the raw logs (log viewer) for the same address pair and if they happen to have the large byte count.

This may be something that needs to have a case open with support.  There have been some issues with wrong byte counts in the past.


Regards,

Oliver