Packet size report

Hello,

I'm _very_ new to Solarwinds and have been asked to generate a report showing total http throughput including packet size with a particular focus on 440 byte packets. Normally I'd use something like tcpdump to capture packet sizes, but I've been told that's not an option at present.

We've got NTA & NPM installed & after a couple of days going through the documentation, googling and experimentation I've got nowhere useful.

So, question 1 - Does anyone know if this is even possible?

and question 2 - Can anyone point me towards the right documentation, or provide any guidance at all?

Thanks in advance

Find more posts tagged with

Accepted answers

All comments

brett.holzhauer

Adam,

I can assist here! Do you currently have a support ticket open?

jericho

Hi Brett,

Thanks. I haven't raised one as I don't have any details for our support contract. I'm a temporary worker who's been tasked with this in absence of the regular network person.

Regards

brett.holzhauer

jericho

Oh okay! I actually meant, Have you opened a support ticket with SolarWinds? If you/your company is a SolarWinds customer, our support team will be able to assist.

Otherwise, I can continue searching for a solution on THWACK. I do see that you are a brand new THWACK member, and wanted to say welcome!

This platform is a great resource for questions/troubleshooting.

jericho

Hi Brett,

Thanks, I've asked the IS manager if we have a support contract and have been met with a blank look which doesn't bode well...

Do you think this is possible then? As I said, I'd normally use tcpdump and filter out the interesting traffic, but in this case the company won't allow any changes to be made while the regular network admin is off sick. There's no monitor / mirror port in place, but all network traffic flows through one logical device which is sending netflow and snmp data to SolarWinds. I have a vague recollection that netflow has some records that relate to packet size but I can't find a way to report on it.

Regards

mesverrum

Despite them telling you that tcpdump is a no-go they are going to need some similar type of deep packet inspection tool to get that granular, Wireshark or something off their firewall maybe.

Netflow (referring to the protocol itself, not the Solarwinds application) does not collect data on packet size at all, so that's going to be a nonstarter. It would tell you the total amount of bytes involved in a particular stream during an interval, but that's an aggregate value so would not be able to tell you how many packets happened to be 440 bytes.

Likewise, NPM is using SNMP data to gather aggregated metrics about the interfaces. During the polling interval X number of bytes, with Y number of total packets, but no detail about any individual packet. I can't think of any Solarwinds tool that is going to be this granular. Even the QoE agent is still going to be aggregating data to the point where you wouldn't see what you as asking for.

nick_scott

Wireshark is free and does not require a contract!

jericho

I did think that would be the case, but was looking at any option to try and solve the issue without changing anything in their setup.

jericho

It's a very risk averse site, their network admin is off and they only provided read only access to the core infrastructure (which is where I'd need to set the SPAN up for tcpdump / wireshark) as they didn't want any changes made without her being on site in case of problems.

The urgency seems to have vanished now and I've been moved on anyway.

Thanks for the replies, I have no doubt I'll be back as where I am now is also using SolarWinds.

Cheers