Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Tracking newly created connections.

I want to apologize if this is the incorrect place for this If so, please let me know.

We run two HA Silverpeaks just behind (logically) one of our WAN edges.

We are having an issue whereby the appliances reboot intermittently affecting our performace. Silverpeak engineering are aware of the bug in their (latest and several older) code levels. They state that this is caused by a spike in newly created flows (syns) recieved by their appliances.

I would like to find a metric in Orion (NTA maybe) that can track top packet senders, I don't think traffic (top talkers ie) is showing us much. I suspect it is a scanner, poller, what have you. We have separate security, EPM, printer groups who have "tools" that do discoveries and the like, that may be causing these reboots.

Thanks in advance for any advice or suggestions.

Matt

Find more posts tagged with

Accepted answers

All comments

adam.beedell

This sounds like an NTA-type problem. You'd need flows exported from something before/after the silverpeak devices probably. That an option?

MatthewUHS

Thanks for the response, yes, NTA is the module of Orion I assumed most able to gather/present the data I'm looking for.

Officially from Solarwinds support: Unfortunately, NTA is not counting or does not have the option to monitor the number of flows that each device is sending. NTA just collates the data from within the Flows that the device is sending. It is not doable at this time. The nearest that we have right now is the Flows Per Second count on the Server. It will not show a per-node number.

However, my thoughts are it does tally along with amount transferred (in MB) the amount of packets and that we could present that in such a fashion as to see many packets, small amount of data xferred and that may lead us to inferences surrounding flows created.

Thoughts/comments?

adam.beedell

Aah I didnt realise you had the data already. I think a basic report for data received / average packet size / time would basically give you a FPS number. Could also just run wireshark for a few minutes to get a number/check the numbers from above.

Feels like a fairly solvable problem, though I'm not sure I'm visualizing your issue well