NTA Feedback

Question

Just installed the eval NTA2.1 and hotfixes last week.  So far I don't like it.

1. I would like to see a view that showed something like the Top XX converstations on the network or device, not just down at the Netflow endpoint level.  Also not just tied to one node, but the Top XX conversation on whatever link I want to look at.  I could then pick a conversation and drill down into it finding out what sort of traffic etc.

2. In Node Details, I would like the choice to show Top XX Recievers.  The only option I see is Endpoints.  I would rather see who or what machines/devices on my network are creating the most traffic, then I could click on it and see the endpoints.

3. In netflow settings I only select the interface I want to see on a non cisco device, but on the Netflow Traffic Analysis Summary page under Netflow Sources I see all the interfaces.  This seems to happen on our Riverbed appliances.  Cisco devices show only those selected.  If I remove those interfaces in system manager, then they go away in netflow.  The draw back to this is I can't have just up/down on that interface without it also showing up in netflow.  I haven't tested other non-cisco devices.

4. When looking at graphs, the X & Y scales are really hard to read.  It is like taking an image and using html to down size it causing text and lines to become jagged.  I have click on through to the custom chart to be able to read it.

5. Cisco VLAN icon shows a "?".  Shows up this way in Orion too though, but I think Vlans are pretty common these days and some sort of icon could be used.

6. One thing I am not getting for example: I see an interface on a router shoot up to 1.27mb.  This is a T1, so around 80%.  So I want to see what is causing it.  I click on that interface from the main page.  Now I am looking at that interface's details at the default 15 minute setting.  Top 5 Protocols show TCP 59.84Mb.  My top endpoint is showing a server with a total bytes of 5.58Kb.  I would think whatever system is causing the high traffic would be at the top.  I change it to Last 5 minutes.  TCP is now 19Mb and top endpoint is a server showing 9.71Kb for total.  It just doesn't seem right to me.  Ok, so I go back to the beginning, NTA home page - interface with high util and look at the Top 5 Endpoints.  I then click the Interface again at the top of the page and it takes me to a node details page with a totally different set of top X endpoints.  It should be the same point I was just looking at.

Overall at this point I think the info I am getting from NTA is just confusing and/or possibly wrong or should I say presented to me wrong.  Maybe it is because I am left handed :) .

FormerMember · Answer

When we're reporting bps, we're using Orion's data that comes from the device via SNMP.  Many other NetFlow products infer bps based on the throughput of the interface and the amount of traffic they're seeing.  If that's the case, the SNMP data will be more reliable.

BakerD · Answer

#6 – The bps is coming from the device itself through SNMP and the NetFlow data is coming from exported NetFlow traffic details, so it is possible the router is not exporting all data.  We will look into it.

Just noticed one thing confusing to me, when looking at NetFlow Node Details of a router and under the Node Interface section it lists traffic in/out as Mbps (Mega bits).  If you then click on that interface, everything on the Netflow Interface Details shows as Bytes.  Am I missing something and there is a reason it is this way?

Also, looking at the same data (router & interface) in two different netflow programs, NTA reports 1.28Mbps and competitor reports in the 800kbps range.  I can't figure out why such a big difference, they should at leaset be close.

Thanks

BakerD · Answer

#3 – you can edit the interfaces that show up in the NetFlow Sources resource by clicking “Edit” on the NetFlow Sources resource and unchecking interfaes you do not want to capture traffic data for.

It doesn't work for the Riverbed 2020/1020 devices that I am testing.  They show up as NBT Technology, Inc.  Under each one only interfaces lan0_0 and wan0_0 show up and I have them selected.  In Orion there are a two other interfaces:  primary and inpath0_0.  When looking at the NTA Summary page, those two interfaces I don't have selected and can't even selected in the netflow sources resource are showing up.  The "Time Data Received" column shows a status of never.  If I deleted them from Orion, then they disappear from NTA.