Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Generating a link to an NTA object

We only have Netflow enabled on our Riverbed WAN accelerators and not our WAN routers as I am being told that Netflow can generate lots of traffic. I have an alert that reports against our WAN interface on our router to alert us of b/w utilization which works fine and I did use the "interface utilization alert with TOP talkers" and that worked great as I was getting netflow info for that interface in the email, but only if the WAN router had Netflow enabled since the alert was against the interface on the WAN router. I want to do exactly that but instead, have the netflow interface details of the Riverbed WAN0_0 interface instead. Does anyone know how to do that, this is beyond my skills . I thought I could just simply include a link to the netflow interface details in the email for that specific interface and it works, however I do not know how to make that link dynamic where it would change depending on which interface was generating the alert. Example:

orion.server:8787/.../NetflowInterfaceDetails.aspxNetObject=NI:3637;T:Today;FD:Both

the only variable I see is NetObject=NI:3637 and they change depending on what device I use. Wonder if there is a way to use a variable that could translate into that value.

Thanks

Find more posts tagged with

Accepted answers

All comments

superfly

This is what I use

http://solarwindsserver/Orion/NPM/InterfaceDetails.aspx?NetObject=I:${InterfaceID}

and in this view I have the netflow widgets added in.

I have netflow enabled on all my WAN routers and even on 3mb links, it works fine. It doesn't cause any issues for me.

rschroeder

While I don't have the answer you seek, I have over a hundred sites with WAN pipes from 5 Mb to multi-gig, serving 17,000 employees across several states, and all my routers have Netflow enabled.

Better still, I have about sixty physicians and transcriptionists who work from home with ASA's providing VPN termination to home broadband ISP solutions, and I've enabled Netflow on all to them, too. Without impact to the home users.

It doesn't cause problems, doesn't generate a lot of traffic. But it CAN show you which devices ARE generating enough traffic to cause troubles for your WAN.

Don't let someone's ignorance or scare tactics prevent you from using Netflow.

At worst, suppose it DOES cause an impact? You'll see it right away in your bandwidth utilization graphs and in NTA's Conversations or End Points or Top Talkers lists, and you can easily shut Netflow off with a simple CLI command. Monitor it in real time, check with the WAN users, and act accordingly.

But if you have ANY spare bits of WAN pipe to grow into, Netflow is a great use for them!

audia4

Ya I have the same sentiment and it's nice see experiences where it's being used widely with no impact.

Thanks

Sent from my iPhone

audia4

Not sure how one is supposed to see actual Netflow traffic in NTA from a specific netflow source. I tried with a WAN router I have Netflow enabled on and looked it up and found nothing, I even filtered using the netflow collector (Orion) ip address and all I see is SNMP between my WAN router and Orion.

rschroeder

If everything is correctly configured, try this process:

Access NPM
Go to My Dashboards > Netflow > Conversations. (You DO have NTA installed and integrated, right?)
Look in the left half for the column labeled "Conversation". It shows ingress and egress bytes and packets and percentages between hosts.

You can drill into these conversations and see the nodes and interfaces participating in the flow.

You can click on the interfaces or on the links in the Ingress or Egress bytes and see even more information.

You'll get protocol information, bytes, sources & destinations, etc.

I rely on NTA's Netflow information to ensure WAN links are appropriately sized and to recognize problem flows, which allows me to limit those flows--or shut them down, if required.

If you're not getting this information, review your L3 devices' Netflow configuration and compare it to your vendors' recommendations. Then ensure Netflow is built correctly on your devices, and that they all show up in your NTA view as recognized and accepted sources.

It might be as simple a problem as your NPM monitoring a router's loopback port, while the router is configured to send Netflow data via a physical interface or SVI. NTA will see the traffic coming in, but will ignore it (or throw up a minor alarm saying "NTA: Unknown traffic was received"). It's easy to go into those alarms and see the incoming Netflow source IP address information of the router, and then compare that to the actual IP address that NPM uses to monitor that router. The two source addresses should be identical, and if they're not, NTA won't accept the data. Of course, this might not be the problem in your case, but I've seen it in my shop.

There are plenty of good SW NTA resources in Thwack. You'll even find the exactly scripts required to build Netflow output on various hardware models in Thwack (including one or two I've uploaded for everyone's use).

Good luck--you'll get it going. Don't despair; it's not too tough to learn and make work. Soon you'll have insight into what kind of traffic is coming from your WAN ports. And even better, if you're lucky enough to be using chassis switches (like the Cisco 4510 with IP or Enterprise licensing), they'll send information to NTA that shows ingress information from EVERY PHYSICAL PORT on the chassis. WAY COOL! I use this and love it. I can prove I don't need bigger uplinks/WAN pipes/Distribution Switches/Core Switches. Or I can prove I DO need them.

NTA and Netflow rock!

superfly

Can you post up the configuration for netflow that you'll applied on your router. Sounds like it's not configured correctly.

audia4

Thanks for the info, much appreciated

audia4

Interesting enough , I was able to see Netflow specific traffic on another WAN router I have it enabled on. Ya probably something with the config. Thx. Doesn't seem to use much b/w, was seeing maybe 200kbps, seems to only export between 3 and 1.6 MB every few minutes.