LAST NETFLOW RECEIVED: Never

surnaihai899

Hi Guys, 

Need some help with NTA, I am able to see the netflow coming into WireShark, I can see CBQoS coming in . I even added the device in another SolarWinds instance and checked i can see the netflow and CBQos data there, but nothing seen coming in my instance. PFB



It is a Cisco C9500-48Y4C switch. Flow record is below

low record wireless avc basic:
Description: Basic IPv4 Wireless AVC template
No. of users: 0
Total field space: 82 bytes
Fields:
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match flow direction
match application name
match wireless ssid
collect routing vrf input
collect counter bytes long
collect counter packets long
collect wireless ap mac address
collect wireless client mac address

flow record wireless avc ipv4 assurance:
Description: IPv4 Assurance metrics for wireless
No. of users: 0
Total field space: 6 bytes
Fields:
match ipv4 version
match ipv4 protocol
match application name

flow record RTKC_RECORD:
Description: User defined
No. of users: 0
Total field space: 23 bytes
Fields:
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match flow direction
collect counter bytes
collect counter packets

flow record RTKC_RECORD_In:
Description: User defined
No. of users: 1
Total field space: 56 bytes
Fields:
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
match flow direction
collect transport tcp flags
collect interface output
collect counter bytes long
collect counter packets long
collect timestamp absolute first
collect timestamp absolute last

flow record RTKC_RECORD_Out:
Description: User defined
No. of users: 1
Total field space: 56 bytes
Fields:
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface output
match flow direction
collect transport tcp flags
collect interface input
collect counter bytes long
collect counter packets long
collect timestamp absolute first
collect timestamp absolute last

 

verwin_u

Hi @surnaihai899 

Need to validate if netflow packet was recieve by sw nta properly with complete flow data. You may also check the nta event for you to have a better visibility why sw nta is not displaying nta data of your switch. 

https://documentation.solarwinds.com/en/success_center/nta/content/nta-last-25-traffic-analysis-events-sw611.htm

Solarwind nta also do have mandatory requirement for your nta configuration. This is the most common reason why nta data is not displaying. Please refer to the link before. 

https://documentation.solarwinds.com/en/success_center/nta/content/nta-required-fields-sw148.htm

You may also reach out to sw support geek to assist you why sw nta not displaying data of your switch. 

Please note that sw support geeks may ask you to see the packet capture for more understanding of the issue. 

*** you may check the nta event. Most common are long flow and interface id mis match.

Base from the shared config your missing a "flow timeout" to avoid long flow.