Netflow report by subnet

We use an ISP to handle our WAN infrastructure. This means that we manage only the switches (usually layer 2...Cisco 2960) at remote sites and the ISP owns the routers. We have read-only SNMP access to the ISP's routers...the ISP's routers are NOT configured to do Netflow. All WAN traffic goes to two head-end routers. At our 6500 switch interfaces which connect to these head-end routers, I enabled Netflow v5...both directions. I see some Netflow traffic and I get Top X type reports, but that is not what I want. When a person at WAN site Y complains of slow network response, I want to be able to see what is happening on that subnet...today, yesterday, a few days ago. Is someone streaming radio or video over a slow connection? Is it legit traffic like SMB or Exchange?

How can I get these reports or real-time data?

Find more posts tagged with

netflow monitoring

Accepted answers

All comments

_chrisb_

How is the WAN traffic routed (especially to the Internet)? If the traffic doesn't pass through the core 6500 switches, then you'll never see the reporting you want from Netflow (from those switches).

Can you enable Netflow on the remote switches? The switches would need to be in NPM as well.

edgarbonnell

At the WAN sites, all non-local traffic is directed to the head-end routers and to the 6500. This includes internet traffic. All internet traffic goes through another 6500 interface.

Being almost exclusively 2960 (layer 2) switches, I don’t think I can enable Netflow at the remote switches. I do monitor all switches in NPM. when I look at the 2960 switching in NPM, I can see the management traffic...which is not much.

I am seeing the WAN traffic at the 6500, the problem is drilling down in that traffic. Out of maybe 300 WAN sites, I want to drill down on the traffic to/from any one of those sites...I don't need to see all the sites as one package.

_chrisb_

Have you created IP Groups under NTA specific settings for each remote subnet?

Show traffic for specific subnet going out to the Internet in NTA - SolarWinds Worldwide, LLC. Help and Support

edgarbonnell

No...the IP groups are 10.0.0.0/8, 192.168.0.0/16 ...

Each site has its own NPM group though.