I just recently started to mess with traffic flow on my x86 Mikrotik and I have added a target which is a Linux VM running nProbe (for the collector) and ntopng. The active flows never match up with each other and the bandwidth usage is reported inaccurately. I’ve tried just using the old latest stable version of ntop and have the same issue. When I perform a speedtest on my 1Gbps connection it is just all over the place. I’ve already made an issue about this on ntop’s github and they were saying it would be because the Mikrotik is reporting the flows at a frequency that is far to low to have any meaningful indication of the bursts from my speedtests.
https://github.com/ntop/ntopng/issues/551
Anyone else seeing this?