Sample size comparison
Here is Netflow data for a WAN T1 rendered with 5-minute samples:
and 1-minute samples:
Notice that red spike before 9:00 and the brown spike after 16:00 are
50-60% lower on the 5-minute graph than on the 1-minute graph. These
were high volume spikes, but they did not last the full sample interval
(or they did not line up on a nice sample boundary). Nevertheless,
these events did peg the WAN and would have impacted other traffic.
On the other hand, the two long orange plateaus are about the same on both
graphs because the event spanned entire sample intervals. Only the edges
of each plateau on the 5-minute graph show evidence of lower reporting.
If you want to look at even more detail, here is a pdf comparing
resolutions of between 1 and 300 seconds