Seeking Correct Netflow Information

Question

Hello all. I'm currently using the following list of products:

* Orion Platform 2017.3.4 SP4, 
* CloudMonitoring 1.0.0, NPM 12.2, 
* QoE 2.4, 
* NTA 4.2.3, 
* VIM 8.0.0, 
* NetPath 1.1.2

I have a couple WAN links to monitor, with a focus on the bandwidth utilization, however when I try to use the Netflow option inside NTA it seems to be giving me some incorrect information. An example, I have a 50 Mbps link that I know is usually at 98% utilization, by design. I've used ManageEngine's Netflow tool vs NTA to measure the utilization and below images are the graphs I get. Why doesn't NTA show that the 50 Mbps link is being used as the alterntive does? What am I missing here?

brownbox · Answer

Ah, thank you for your reply, Rick. You make a good point, and I should have explained further that this link is being used primarily for site backup and so the mainly utilized protocol is TCP. I'll post what I consider an apples to apples comparison below, looking at protocols between 6AM to 12PM today. Let me know what you think, please.

The Netflow settings on the router are the same, in that the record and monitor settings are the same with only separate exporters sending the  flows to two different applications therefore I'm certain the correct interface is being monitored.

The CLI shows that the interface is indeed showing a regular input rate of ~49 Mbps: "5 minute input rate 49285000 bits/sec, 4107 packets/sec" so I'm thinking the ManageEngine graph is correct while NTA's is not.

rschroeder · Answer

I'd be tempted to look for easily-explained human interpretation / settings differences between the two products.

Your NTA graph shows it's only displaying data from the Top 5 Protocols, while the other product's graph doesn't appear to be filtered at all.  Try looking at the options for either product and select the same kind of filters so you're comparing apples to apples.  You might discover you're comparing oranges to orangutans by having differing filters in the two graphs.

Double-check the specific interface(s) being monitored by each product; ensure both products are looking at the same node, and the same physical or virtual interface.

If things still don't make sense, open a support case with both vendors and ask for help ensuring you're using both products identically.

My gut feeling is that the NTA data being displayed in the graph is being filtered somehow, or that it's not polling as frequently or as fully as the data shown in the other product's graph.

You should always be able to access the CLI of the node and do the simple math for a reality check--how many bits or bytes or packets or frames are being forwarded through that port (without being dropped by some ACL or other filter based on src or dst)?  Divide the data rate by the time measured and you should get the true bits per second, instead of what either products' Netflow data graph shows.  Human understanding, and error, is probably the thing you'll find to be needing a little tweak for getting the graphs to match.

Let us know what you discover, and what fixes the two so they show the same data flow rates.

Swift Packets!

Rick Schroeder