While working on Orion NetFlow Traffic Analyzer (NTA) v3.5, our dev staff spent a lot of time analyzing your packet captures.   What they found was really interesting!   On many networks, up to 95% of all network traffic (i.e. Top Talkers) can be captured and analyzed from as little as 4% of the total amount of Flow data received from monitored Flow sources. 

So, if you are primarily using Orion NTA to determine the "top talkers" on your network, you are probably storing a lot of unnecessary data in your Orion DB. As a result, your Orion DB may be unnecessarily large and the load times for Orion NTA resources and reports may be unnecessarily long.

Have no fear!   With Orion NTA v3.5 and v3.6, you can enable Top Talker Optimization to significantly improve the performance of your installation!

Existing v3.5

If you’re using NTA v3.5, you can still manually enable Top Talker Optimization by following the steps outlined here.

New to v3.6

If you’ve installed NTA 3.6 from scratch, Top Talker Optimization is already enabled - nothing more for you to do!  

Upgraded to v3.6

You can enable Top Talker Optimization to significantly boost the performance of your installation in just two easy steps:

1. Navigate to NTA Settings in Orion Admin area

2. Set Top Talker Optimization to 95%

image 

That’s it!  

NOTE:  If this is an existing DB, configuring Orion NTA to keep compressed data for 14 or fewer days can accelerate the effectiveness of Top Talker Optimization. You can change this by navigating to NTA Settings in Orion Admin area and change Keep compressed data for XX days to 14 or less.  Allowing Orion NTA to run in this mode for a couple of weeks, or at least longer than the number of days provided, will ensure that all the old, unnecessary compressed Flow data you collected prior to enabling the Top Talker Optimization is flushed from your Orion database. After the old compressed Flow data is deleted from your database you should see noticeable performance improvements in Orion NTA resource load times.

So, to close out this post, let’s answer the million dollar question…what does Top Talker Optimization buy you as far as max flow rate?

Well, here's a reference implementation from a customer who's been able to obtain 40,000 flows per second and 60,000 flows per second in peak.   That’s over 3 million flows per minute!! 

  • Orion Server
    • Intel Xeon Dual Quad Core @ 2.00GHz
    • 4.00 GB of RAM
    • Disks – DELL PERC 5/I
    • 6 136GB 15K – RAID 5
    • 8706 elements
    • 279 NetFlow interfaces (spread across 6 devices)
  • Additional Poller 1
    • Same HW as Main
    • 9309 elements
  • Additional Poller 2
    • Same HW as Main
    • 10893 elements
  • SQL Server
    • Server 2008/SQL Standard 2005
    • Intel Xeon Dual Quad Core @ 2.50GHZ
    • 8.00 GB of RAM
    • Disks  -DELL PERC 6/i
    • 2 300GB 15K – RAID 1 (Operating System & DB Log)
    • 4 300GB 15K – RAID 10 (DB files)

We’d love to hear about how Top Talker Optimization is working for you.   Post your story here.