95th Percentile Bandwidth Utilization using Netflow

I have a customer that is interested in obtaining 95th percentile values in Kbps/Mbps using the NTA product.  The catch is that they would like to do it per IP group. 

For example, they would like to get a single value for 95th percentile bandwidth inbound to

Is there any way to do this using the product?



  • Hi,

    There is not currently in NTA 3.8 not possible to get 95th percentil via WeB UI charts.

    However You can create Custom Report by using report writer.

    I attached non official 95th percentile reports for IPGroups. Values are presented in (Bytes per seconds) Bps only. 


    Installation of reports:

    Copy files with extension OrionReport into reports directory (../Orion/Solarwinds/Reports) on main poller and addtional web sites


    Please let me know Your questions, comments about attached reports.



    Regards radek

  • Thanks Radekn.  This works great.  Do you know if there will be support for this type of functionality in the GUI in the future? 

    Another thing I was interested in using IP groups, but only to track a specific conversation, for example to  Is this possible using IP groups right now? 

    I guess what my question is, how do IP groups work?  For example when I enter two subnets in a single group:

    Does the flow have to match both subnets to fall under this IP group or just one?  It seems like there should be a way to specific the logical and or the logical or for the group.

  • Hi Mattyo,

    The 95th percentile on GUI is on the list of customer feature requests.

    I attached new 95th percentile IP Groups report which supports IP conversation filter (from Source IP to Destinantion IP).

    If you have two subnets in a single group then flow has to match at least one subnet in order to fall under this IP group.

    It is the logical OR.

    Please let me know any other questions,comments.


    Regards radekn

  • Hi Radekn,

    For the "last month" report, is that using data from the last calendar month (say you ran a report on July 15, it would report on data from June 1 - 30) or is it by the last 30 days (running report on July 15 gets you data from June 15 - July 15) or none of the above?



  • Hi Mattyo,

    In Your example the "last month" report will show data for whole previous month ( from June 1 - 30 ).

    If You want to see a data for last 30 days from June 15 - July 15 than You will need to have a new report prepared.

    The new report for last 30 days You can create by copy of the report for the last 7 days and modify (by ReportWriter) start time variable ( from SET @StartTime=GETDATE()-7  to SET @StartTime=GETDATE()-30 ).




  • Hi Radekn,


    Another question for you.  In looking at the report for live traffic (for the current month).  These are the numbers that I am getting:


    This is for private addresses.

    Ingress           Egress             Total

    36364959    39829696        36364959  


    This doesn't make sense to me, that the total is equal to ingress traffic.  Could you please explain what the total field means and how it is computed? 

    My setup is 4 Cisco routers with ip flow ingress and egress configured on a single interface (logically the "inside" interface) streaming data to the SolarWinds collector.

  • Hi Mattyo,

    Yes this is a bug of the report. I fixed it and attached new version of the report.
    I also added maximum 95th percentile ( the percentile of maximum values from both Ingress and Egress traffic )

    Please let me know other questions You have.


    Regards radekn

  • Hi Radekn,


    In the new version of the reports the ingress traffic is identical to egress traffic.  The total works fine, but I am curious as to why this is happening as I was expecting the traffic to be quite asymmetric (much more traffic going out versus coming in).  Any thoughts?




  • Hi Mattyo,
    Can you send me example screenshot (NTA web page) with is asymmetric traffic, please?
    Regards                Radekn
  • Hi Radekn,

    Here is what the SolarWinds UI is looking like.  Router 1 is the Netflow exporter.  All the traffic captured in the IP Groups in the 95th percentile ip group report are going through this router.  It is thought that ingress and egress traffic are going to look different, rather than identical as in the report.  I think a previous version (the one that displayed units only in bps) had different values.  The scenario here is that Group 1 has a list of public IP addresses of http servers.  We want to know the breakdown of the web traffic for each group of web servers from users coming over the internet.

    Router12/15/12 4:30 PMnever
    GigabitEthernet0/0 · Outside/ISP interface4.49 Mbps11.01 Mbps2/15/12 4:31 PMnever
    GigabitEthernet0/1 · Inside Interface11.07 Mbps4.74 Mbps2/15/12 4:31 PMnever
    Tunnel1 · VPN Tunnel 162.92 Kbps6548.09 bps2/15/12 4:31 PMnever
    Tunnel2 · VPN Tunnel 214.6 Kbps21.05 Kbps2/15/12 4:31 PMnever
    Tunnel3 ·VPN Tunnel 3130.78 Kbps136.2 Kbps2/15/12 4:31 PM

    Here is an excerpt of the 95th percentile report.  It is strange to me that ingress bps and egress bps are equivalent.

    95 Percentile Per IP Group - This Month

    NameIngress bpsEgress bpsTotal bpsMaximum bps
    Group 1667.3 Kbps667.3 Kbps1.3 Mbps667.3 Kbps
    Group 22950.0 bps2950.0 bps5900.0 bps

    2950.0 bps