This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

NTA SHOW WRONG BANDWIDTH VALUE

Hello.

We use SolarWinds NTA and cisco 2921.

Netflow enable on several interfaces (LAN, tunnel, WAN).

Cisco Netflow configuration is:

ip flow-cache timeout active 1

ip flow-cache timeout inactive 15

ip flow-export source Port-channel1.100

ip flow-export version 5

ip flow-export destination 10.10.10.225 2055

Our WAN interface throughput is 20 Mbit, but NTA shows:

wan.JPG

top5.JPG

but, interface statistics value is correct:

true.JPG

Why?

Here is load interface statistics in cacti:

cacti.JPG

  • Duplicate flows will be created if both ip flow ingress and ip flow egress  are configured on multiple interfaces causing data to show double of actual bandwidth utilization. If using Flexible Netflow this would be or ip flow monitor MONITOR_NAME input and ip flow monitor MONITOR_NAME output.

    Take a look at the article in the link below

    https://support.solarwinds.com/Success_Center/Netflow_Traffic_Analyzer_(NTA)/Theory_of_Duplicate_Flows 

    The Top Endpoints resource shows more data by design since it shown individual Endpoints.  This is due to Endpoints from a conversation being separated and assigning the total bytes to each one,

    For example:

    The Top Endpoint resource show more data ( double if all data is displayed) by design due to Endpoint in a conversation being separated.

    In the  charts below you can see that the bandwidth and the total bytes are doubled.  In order for the charts to match you can either edit the Top Endpoint display as a Line Chart or ass the Top Transmitters and Top Receivers resource to the view.  This will place the End Point in their respective direction.

    pastedImage_8.png

    pastedImage_9.png