NTA & NPM bandwidth Utilization are not the same?

Hi Guys,

I have been faced with an issue on NTA and NPM. The issue is, when I look for bandwidth utilization on SVI via NPM and NTA, the bandwidth utilization are not the same, they are completed do not match. In some case, our Internet circuit is 100-Mbps whereas NTA report shows sometimes bandwidth utilization about 195Mbps, which is impossible, and when I look at NPM for the same interface for same time period the bandwidth utilization is about 110Mbps (assuming ISP allow to burst (bc)).

I have opened a ticket with Solarwind and spoke with 3 or 4 different people, but none seems to know the source of the problem or the solution for this mismatch bandwidth utilization report on NTA and NPM.

Does anyone else experience this problem?

Thanks

Rizwan Rafeek.

Find more posts tagged with

disa_stig

network_monitoring

network_management

Compliance

Accepted answers

All comments

mharvey

If memory serves, you aren't seeing total traffic reported by NTA, you are seeing top 95% traffic based on monitored applications and ports on the interface. Further, as opposed to NPM that is doing a running average of the data based on SNMP queries, NTA is relying on PDU packets being sent from the router with the port and amount of traffic being sent or received (based on whether you are looking at ingress or egress traffic). You are also looking at a more granular capture of top ports and protocols in a 15 minute time frame. The totals NTA shows, I believe, are based on the traffic reported of those ports, and the top XX that are showing in the charts you are viewing rather than all traffic. This would be why you are seeing a discrepancy between NPM and NTA in terms of bandwidth.

Regards,

Matthew Harvey

Loop1 Systems

mrm.rizwan

Hi Matthew,

Thank you for your reply. I try to understand your post, but it does not make sense. How NPM shows FW's outside interface bandwidth utilization is 34Mbps (as highest bandwidth through put) whereas NTA graph shows bandwidth utilization is above 50Mbps.

mharvey

You can't compare the max of a recent poll to NTA. Mainly due to the fact that NPM only gets one poll and there is no try min/max value. One other thing to look at with NTA is, if this is a Cisco device, do NOT have ip flow ingress AND ip flow egress on the same port. This will actually lead to the router reporting double the actual usage on the port by having it send the information twice. This can lend to some such discrepancies.

mrm.rizwan

Hi Matthew,

If what you are saying is correct then, there is no accurate piece of information that I can use on NTA, other than its pretty pretty colors in the graph.

inaccurate data is, equal to no-data at all and it is useless. I don't know why we are paying for NTA an annual contract. For sure, my manager will insists on removing NTA configuration on gears, because it has its own overhead on the CPU. Anyway, I thank you for replies.

FYI...

On Cisco ASA, there is no interface-level configuration goes on ASA itself, but all of which are global commands.

Thanks

Rizwan Rafeek.