Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Endpoint-centric Traffic Analysis Resources

Endpoint-centric Traffic Analysis Resources - ability to see traffic analysis data related to a specific Orion node (non-NetFlow source). For example, the ability to open an Orion node details page for a Windows server and see the top conversations to/from this server.

Chris-

This one seems like a no brainer to me and in a lot of ways it's hard to believe that this isn't a major part of NTA already. It seems one of the main uses for netflow would be to see conversations to and from any endpoint. For example to look at traffic going in and out of from an application server or web server. I often see requests from people in the regular NTA forum asking about how to create a report like this. I would think in addition you would want to see what ports are being used to and from the endpoint also.

Find more posts tagged with

Accepted answers

All comments

jswan

I completely agree with all of ecklerwr1's points. For example, why doesn't the "TopN Conversations" view have the full layer 4 conversation details immediately available?

chris.lapoint

Endpoint-centric Traffic Analysis Resources

I'm really glad you see the value in this enhancement! Others, please chime in if you have use-cases for this feature. It's going to be an expensive one (that would preclude other features) so your feedback will help prioritize.

I would think in addition you would want tosee what ports are being used to and from the endpoint also.

See screen shot below. Is this not what you're looking for with respect to ports?

NetFlowConversationwithPort.PNG

ecklerwr1

Chris-

You got it! It seems like you already have the primitives to create something like this in the software... although maybe if I think through the logic involved it's not as trivial as it seems. But if you think back... even back in the old suitcase sized network general sniffer days you could basically do this. I know with the speed of networks and the amount of data collected some of this is becoming more and more difficult to sort through. Despite this it seems being able to isolate out any end to end conversation from your heap of netflow data is a requirement really. I really appreciate all the work you all have put into constantly improving the NTA product.

jswan

The view above is useful, but (IMHO) it needs to show specific port numbers instead of the mapped application name. For example, I'm looking at a conversation now that shows "random high port" on one side and "wellKnownPorts" on the other side. It would be much more useful to see exactly what ports are involved in each flow.

Also, NTA needs the ability to search for arbitrary flows between two points and jump immediately to this view, rather than going through multiple clicks to get there. Right now (as far as I can tell anyway), if I want to see this info I have to:

Build an endpoint search
Select an IP address
Select a node
Select a time period
Search
Hope that the 2nd endpoint shows up in the top X conversations with the first endpoint.
Drill into the conversation details

I would rather have a search dialog where I can enter both endpoints, have the option to either select a node or use all nodes, and get conversation details immediately.

chris.lapoint

jswan, great feedback. For internal folks, this is being tracked as #3375