NTA Use Case Question

mcbridea

Hello NTA Community!

In speaking with a bunch of you at Cisco Live and Interop I heard many different use cases for NetFlow.  I'd like to get a feel for how you use NTA in the below categories:

1. I use it as a real time system, looking to see what is eating up bandwidth now to troubleshoot issues and rarely, if ever, look back more than a couple of hours.
2. I use it as in case 1 but I will sometimes look into data from the past week or so.
3. I often look at historical reports from two weeks back or more as well as using it as in case 1 and 2.
4. Other which I'll explain in my reply now....

If you had the ability to push a button to optimize NTA to operate as one of these system types with the benefit of faster performance for less data retention, which use case would you choose?

Thanks - Andy

slbrodbeck

 We are new to running NTA here so we are just trying to get up to speed. We set our system to keep 120 minutes of uncompressed data and 185 days of compressed data.

 

Right now we are using it in Category 1 mode. We just implemented some new circuits and are trying to see what chaos is exists.

 

The plan is to begin using it for Category 2 more and more with a little Category 3. We are undergoing a major application development push. During the past year we have gone from 10 application development contractors to around 40 while our internal staff remains the same at about 20. They are trying to push out as much new code before the administration change in January (I work for a state government agency).

 

We are forced sometimes into Category 3 since our level 1 field staff are not the quickest to report problems to us (level 2 and myself at level 3). Numerous times problems have gone on for weeks before we even hear about them. We are struggling to have our level 1 techs be more proactive with problem reporting. Because of this, I have given them access into Orion and NTA to see data pertaining to their sites. That way they can check on this and maybe notify us a bit sooner.

 

As for a Catgory 4, well, we have used some reports and plan to use many more to show management that the application development team needs additional training and tools to test their new systems over a WAN link. We already are trying to get them to re-write an application since it is a WAN killer that downloads all financial transactions from the mainframe and then filters out most of the data locally. For some reason it works great in their cube which has gigabit access to the mainframe while the end users are on the far side of a T-1 link.

 

We also plan on using it to show that we can not sustain the 10s of GBs of transfers that people seem to want to do. It is not uncommon for people to copy 50GB across a 3MB link because they want the GIS (maps) data locally. We plan on using the data from NTA and Orion to justify our attempts to change the business process.