Sample size comparison

Here is Netflow data for a WAN T1 rendered with 5-minute samples:

and 1-minute samples:

Notice that red spike before 9:00 and the brown spike after 16:00 are 50-60% lower on the 5-minute graph than on the 1-minute graph. These were high volume spikes, but they did not last the full sample interval (or they did not line up on a nice sample boundary). Nevertheless, these events did peg the WAN and would have impacted other traffic.

On the other hand, the two long orange plateaus are about the same on both graphs because the event spanned entire sample intervals. Only the edges of each plateau on the 5-minute graph show evidence of lower reporting.

If you want to look at even more detail, here is a pdf comparing resolutions of between 1 and 300 seconds