SolarWinds NetFlow Traffic Analyzer (NTA) 3.8 was released last month. In case you missed it, below is a quick overview of some of the cool new features now available. You can find the release notes here.
- BGP Support
- Huawei NetStream
- Flow Navigator
- Endpoint Centric resources
- Unified UI (most NTA resources can be placed on most views)
- Performance Enhancements
- Account limitations
- Service doesn't restart after database timeouts
- Export to PDF issues
NetFlow v5 and v9 include information in the flow about source and destination BGP Autonomous System (AS) fields. This is a feature for customers who need to track flows across multiple service providers. If you don’t have multiple service providers then you most likely don’t even need to worry about BGP. But if you do, then you are probably very interested in this feature. Here is a quick example of how to configure your router to include BGP information in the flow data(assuming you already have BGP and NetFlow configured on the router).
Router(config)# ip flow-export version 9 origin-as
The origin-as command is saying to use record the AS that the traffic originated from. The other option is to use peer-as which will record the AS of the peer. I prefer recording the origin AS, but you’ll need to decide what information is the most useful in your network.
Adding the BGP AS data in to your flow data can have an impact on your router. I recommend monitoring the CPU of your device to make sure you don’t see any negative impacts after you enable this feature. Also, this should be enabled after hours or in your change management window instead of during the day. Once we are receiving the data, NTA includes two resources that will help you use this information; the Top 5 Autonomous Systems and the Top 5 Autonomous Systems Conversations resources.
SolarWinds NTA now has full support for devices that use the Huawei NetStream flow standard (ex: Quidway NetEngine 80 and 40 series routers). SolarWinds had support for other Huawei flow capable devices, but the NetEngine routers required special work to support. From a user perspective you monitor them just like any other flow enabled device in NTA:
- Add the device to NPM
- Monitor the source flow interfaces
- Configure the device to send flows to NTA
- The flows should be automatically picked up and added to NTA
- Enjoy your data!
Flow Navigator is an awesome new feature that makes finding specific traffic much easier. On all of the NTA pages, you will see a Flow Navigator icon on the upper left side of the page. If you click the chevrons (>>) then the Flow Navigator will fly out on the page and you can create a customized view of data. For example, if you want to see all web traffic from your site through a specific service provider, simply select port 80 on the Applications option and specify the appropriate BGP AS numbers. Here is a screenshot of the Flow Navigator expanded on to a page.
One other really handy feature is the “Save filtered view to menu bar” button. This allows you to quickly save your work so that you can re-use the view or make it available for other people. Simply click the button and provide a friendly name and the menu bar will be updated with your custom view.
Endpoint Centric Resources
Endpoint centric resources are essentially resources that have been added to your existing managed nodes so you can quickly see traffic information about that particular node. This can be particularly useful if you are trying to troubleshoot application and server issues because you will see the traffic being sent to and from that server on the same page where other pertinent application and performance data is displayed.