The GUI definition of the “Analyzed” metric is “The total packets of the network capture.” The actual metric is “Capture System Health - Total Throughput”.
Does this metric include L2/L3 duplicate and packets that processed into metric data? For some reason I thought this metric was “post-dedup”, but I can’t find any documentation to back that up.
The reason for my question is that we’ve enabled dedup on a packet aggregator and we observe a drop in the “Analyzed” metric, which is slightly more than the amount of L2/3 duplicate traffic which raises concern that the data feed is “loosing” traffic somewhere. The L2/3 drop almost completely, uni-directional packets decrease, desyncs do NOT increase and the “analyzed flows” metric looks comparable. So by all measures it would appear that dedupe working and not affecting the data feed, but I wanted to get clarification on the metric definition. Thanks!