NTA feature request -- simple text views

jswan

One of the most common things I want to use NTA to do is to characterize traffic prior to adding access lists or modifying firewall rules. To do this I need large lists of the conversations that cross an interface. I typically end up making large "top x conversations" views, copying them into a text editor, and using various methods to extract IP addresses.

When copying and pasting from the web interface, however, there is a lot of garbage that comes along with it. I would like to have a way to get this information in plain text format.

In theory I could do this with SQL Query Analyzer, but I am not a SQL expert and without better documentation on how the database is structured and examples of how to build common NetFlow queries in SQL I'm out of luck there.

ecklerwr1

I created a netflow report Top 10 Netflow Conversations that traverse a cisco netflow exporter during past 24 hours

You can add another condition like this to narrow it down to one router or interface:

You can also adjust the the timeframe or how many of the top XX you want to view to get a look a what's using up most of the bandwidth.  It's a lot easier to copy the data or export the report to excel this way versus what you were talking about (which I've also done) ie. copying it from them webpage and picking up all the extra junk characters you don't want.  This helps to see if there's a big traffic offender you want to add to a firewall rule or ACL to reduce traffic loads.

I'm glad to see SolarWinds has been putting a lot of effort into improving NTA but we have a ways to go... like the Endpoint-centric Traffic Analysis Resources (no brainer).  Now with Cisco putting so much effort into nbar and new QOS options we are going to need advanced reporting and more flexible visualization options from NTA more and more.