Dear community members
We would like to request a new feature for the Solarwinds NTA which is currently not available - the support for the IPV4_NEXT_HOP field as described in RFC-3954.
We are using Flexible NetFlow to gather information about flow statistics in our backbone. Being a carrier we need to identify the amount of traffic (including a analysis) that we exchange with our peering partners in public peering VLANs. These are environments where we peer with multiple carriers, in various BGP autonomous systems, over a single interface (i.e. VLAN). For example we have hundreds of networks reachable over the same interface but with different next hops - each next hop uniquely identifies a peering partner. To be able to analyze how much (and what type) of traffic is exchanged with each peering partner, we implemented the IPV4_NEXT_HOP field as part of our NetFlow record using the following (Cisco) configuration:
flow exporter NTAExport
destination 194.150.198.78
source Loopback0
transport udp 2055
flow record NTARecord
match routing destination as
match routing next-hop address ipv4
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
match interface output
collect counter bytes
flow monitor NTAMonitor
exporter NTAExport
cache timeout active 300
cache entries 200000
record NTARecord
where the flow monitor NTAMonitor is applied under the interface and we see the next-hop IP address in the local NetFlow cache on our routers:
The configuration works as expected and for each flow the next-hop IP address is reported as well (see image below), but ignored by Solarwinds NTA.
If this field was supported by NTA we would be able to group flows according to the next-hop IP address and know how much of traffic (incl. analysis) was exchanged with each peer.
I can imagine this might be very useful for everyone connected to a shared network segment (Ethernet VLANs, VPLS, Frame-relay/ATM P2MP VCs, DMVPNs, etc.).
Best regards,
Martin Hruby
CCIE #43961, Senior operations engineer
Comfone, Switzerland
