nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
- SolarWinds Academy
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Calculating Flow per Interface and Max Capacity Limits (Legacy NTA vs Self-Hosted)

ImNishat

Hi Professionals,

I am looking to get a clear answer on two specific questions regarding NetFlow monitoring capacity and sizing. I am comparing the legacy NTA module against the newer SolarWinds Observability Self-Hosted platform.Here is what I am trying to figure out:

What is the absolute limit for NetFlow-enabled interfaces?
I know that the old 50K FPS per poller limit is still the architectural baseline. However, I want to know exactly how many netflow-enabled interfaces we can monitor in both cases. For legacy NTA, it seems bound to explicit interface/element licensing. For SolarWinds Observability Self-Hosted, since it uses node-based licensing, how do we determine the max interface limit for flows?
How can we calculate how many FPS an individual interface is sending?
Is there a native way, a specific formula, or a database query (like SWQL) that allows us to see exactly how many Flows Per Second (FPS) a specific netflow-enabled interface is dropping onto the polling engine? I need to figure out which high-traffic interfaces are consuming the most of our 50K FPS budget.

If anyone has any inputs or suggestion, a custom dashboard query, or a clear breakdown of how the platform calculates interface capacity under the hood for these two versions, I would really appreciate your insights!

Thanks!

Find more posts tagged with

support.

nta - network traffic analizer

SolarWinds Self-Hosted Platform

solarwindscertifiedprofessional

SolarWinds HCO

Comments

cnorborg

The limit will probably be on your database server rather than your SWOSH environment. With the old licensing if you pushed the limit on whatever server was receiving your flows, you had to purchase APEs (Additional Polling Engines). With the new licensing model you can deploy as many APE's as you want. Since the flows are pushed from the remote device, its kind of less work for the receiver of those polls. But, storing everything on the database and working with that data, summarizing it and such, will be the bottlenecks? So, make sure you put the database for the Netflow data on its own box, make it really beefy, and let us know how many you get?

The guidance for all of this is here if you really want to look at it: https://documentation.solarwinds.com/en/success_center/observability/content/configure/install-network-collector.htm#Require

They're saying 7,000 devices per collector, they don't go by interfaces?

The # of flows an interface produces really depends on the flow of data through it. If you have a box that is processing 100,000 SSH sessions per hour, its probably going to do a ton more flows than a storage system moving big files. Why? The 100,000 SSH sessions are all separate flows, while the storage system moving big files is only a few flows for each file moved. So even though you are probably moving more data for the storage, the SSH would probably produce more flows. And there is the whole spectrum of data in the middle that will produce different amounts of flows. Best way to find out? Start doing it and pay attention to what's going on, very hard to plan for.

Quick Links

PALO-ALG - Logging
PALO-ALG - Logging.xmlPalo Alto Networks ALG Security Technical Implementation Guide :: Version 2, Release: 3 Benchmark Date: 27 Oct 2022
Alert HTML Content
Alert Cleared.htmlHello, I would like to share the HTML template details we have prepared so that Solarwinds alarms can become more meaningful. It can list alarm object details and connected device details separately in HTML template. Except for object and device details, you can easily add custom property information…
Cisco ASR Devices
Cisco ASR Devices.pollerCisco ASR Devices
Basic SWQL Syntax
SWQL is built on the framework of SQL and as such supports most of the standard clauses as part of a query. A very simple example query is: SELECT Caption, IPAddress, Vendor, ResponseTime FROM Orion.Nodes Dissecting this query is relatively straightforward: show some fields (Caption, IP address, Vendor, and Response Time)…