FlowSphera 1.14.0 release notes

The interfaces' own counters over SNMP. For every device with SNMP on, the collector reads each interface's 64-bit octet counters (32-bit where a device has no others; a wrap is undone), errors, discards and state every minute. Capacity takes them for every day they cover: every byte the port carried, the busiest minute (not five), and links that no flow describes at all. Settings → Devices shows when they were read last.
Settings → Devices → Interfaces: the load column names its source — «Load (SNMP counters)» for the minute reads, «Load (sFlow counters)» for sFlow counter samples (the SNMP reads were shown under the sFlow name).
What the flows see: per link and direction, the bytes in the flows against the interface's counters. Below 80 % the export misses traffic (an interface without a sampler), above 125 % it may be exported twice — said on the card on top, in the link's sentence, in the table and in the reports.
Capacity on a busy firewall: «Not enough memory for this period» (a customer on 1.13.1). The 5-minute totals were grouped by the pair of interfaces before being split per interface — thousands of VLAN / tunnel pairs × the period's buckets; now each record goes to its two interfaces as it is read (measured: 1.75 GiB → 182 MiB on 20 M records with 3,600 pairs), and the grouping may spill to disk instead of failing.
Capacity — visual first: the cards, the trend chart with a link picker, the hours of the week and the hosts and services come first; the table of all links is at the bottom (a row picks the link above).