IMO this is self explanatory. "Top" hosts is just that - the top n, or (3) in this case. The other stats presented are for the network as a whole. So in your case, do you have a bunch of other users at small throughputs that add up to... 13.5'ish Mb/s?
I agree the data in your attachment looks a little odd; but it does depend on you environment. For SOME of my nets the top 3 represent 75% of the total throughput, while others it may only represent 20%.
Also keep in mind, that this graph represents: Ingress + Egress = Throughput. So, if you're trying to reconcile total throughput with the top 3 users - you'll need to add top 3 Tx AND Top 3 Rx. But again, this total MAY only represent a fraction of the total network throughput.
From: email@example.com [mailto:firstname.lastname@example.org] On Behalf Of Sean Staats
Sent: Thursday, September 22, 2011 9:05 AM
Subject: [Ntop] Average Thpt not matching Top Hosts Sent/Rcvd Thpt
On the Network Load Statistics Matrix page, the sums of the "Top Hosts Sent Thpt" and "Top Hosts Rcvd Thpt" do not come close to equalling the "Average Thpt" for each "Sampling Period." I've attached a screenshot. Why is this happening and how can it be fixed?
System: Ubuntu Server 11.04
Ntop Version: 4.0.3
Thanks for your help!
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."