New to NTA - Traffic Question

dledwards

Hi,

Just installed NTA 3.1 and configured a couple of Cisco routers.  Devices showed up in NTA and were added without any problem.  Seems to be collecting data.

This particular link is constantly saturated.  I'm 90% certain that the traffic is from our IP video suveillance cameras at this remote warehouse.  However, I don't see any of this traffic in NTA.  The link shows 98% utilization in Orion, but I'm only seeing stuff like NTP and SNMP in netflow.

Is it likely that the heavy traffic is from an app/port that NTA is not monitoring by default?

Any ideas on what port(s) to add?

Thanks,

DE

kweise

DE,

Without knowing how you have your router set up, it's kind of hard to answer your question.  I have run into something similar before and depending on your setup, there are a couple of things that might be causing your issue.  First off, do you have CEF enabled on your router?  If not, I believe you'll need to enable it to see all of the flow data. 

Secondly, are you using subinterfaces on your router?  If so, you'll need to put the ip route-cache flow or ip flow ingress or ip flow egress statements on the subinterface.  You'll also want to make sure that you are monitoring the subinterfaces in Orion, otherwise you'll get messages in your Orion Event viewer telling you  there is a missing NetFlow interface for your router. 

Hope this helps.  If you have any other questions, just let me know.