radekn ✭✭✭✭✭

Hi, Please find out interface index number for Ingress/Egress below in example picture. Both indexes should be greater then zero. Regards Radek

Hi, Could you confirm that you router it exporting netflow for egress traffic as well? You may use wireshark in order to confirm this. You may also check router config if netflow is enable for you router egress interface. NTA should display egress traffic as well if it is present in netflow traffic exported from router.…

Hello, Could you confirm that you are ok with attached SDK wiki link ? github.com/.../wiki Regards Radek

Hello, Bittorrent traffic is using protocol 6881-6889 and 6969 for the tracker port so it is possible to monitor it with NTA. However for DHT extension (peer2peer tracker) it use various UDP ports which are negotiated by the peers so if you know actual peer2peer DHT port you can also monitor this by NTA. In case of…

Hello, I seems the NTA DB schema shows there was installed version 2020.2.6 but NTA application main/poller is actually running lower version. You may upgrade you NTA main./poller to 2020.2.6 and use this NTA DB. If you have still troubles ,could you contact support please? Regards Radek

Hello, Did you try to add resource "IP Groups Conversations" to NTA summary page and use "flow navigator" menu to filter your application port number? Regards Radek

Hello, There should be possible to see NTA pdf report with toptalkers in alert email. Please check if you have it enabled in alert action manager? Regards Radek

Hello, Could you confirm the device is exporting netflow data to orion (default port 2055, you may use wireshark to find out)? Regards Radek

Hello, Did you try apply setup based on www.solarwinds.com/.../nta-cisco-nexus-7000-7010-sw2057.htm ? Regards Radek

Hello, You may try similar query in swis, the number of joined entities depends on installed orion products. The list of all entities which are possible to made dependency with is listed in swis table "Orion.DependencyEntities" SELECT dep.[DependencyId], dep.[Name], dep.[LastUpdateUTC], dep.[ParentUri], dep.[ChildUri],…

Hello, Could you check that "bytes through" and Timestamp column name exists in data source(did you change it from original "I want to report on Netflow by Conversation History" to another entity? ) if original data source entity was changed please remove those columns on custom table page (recycle bin icon) and add new…

Hello, You may clone "top 100 conversations" web report and modify query conditions and switch shows "all records" instead of "top 100". Please let me know if you need more info? Regards Radek

Hello, In table NetFlowStorageSegments the "Versions" column is there to help distinguish last changes of existing IP group so NTA knows that previous versions of the same IP segments for this IP group are not valid anymore. So in query we should take into account only maximum version of IP segment as the most actual…

Hello, Please see connections between segmentID in flows tables for swis and sql query. SWIS Query: SELECT TOP 5 Segments.IPSegmentID, IPGroup.Name, Ranges.IPRangeStart, Ranges.IPRangeEnd FROM Orion.Netflow.IPAddressGroups AS IPGroup LEFT JOIN Orion.NetFlow.IPGroupSegments Segments ON Segments.IPGroupID =…

Hello, Could you try to remove Timestamp from GROUP BY and aggregate over timestamp? SELECT TOP 15 MIN(TimeStamp) AS StartTime , MAX(TimeStamp) AS EndTime , SourceIP as A_IP , SourceHostname as A_Hostname , DestinationIP as B_IP , DestinationHostname as B_Hostname , ROUND(SUM(Bytes) / (1024 * 1024),2) As BytesMB ,…

Hello, Do you using default SQL instance name or customized ? In what format you are typing in field "SQL sever" in Configuration Wizard dialog at "NTA Flow Storage Configuration" Configuration Wizard screen, please? What type of authentication are you using on the same page "NTA Flow Storage Configuration" Configuration…

Hello, You may open flow navigator on NTA summary page, and in "Applications" drop down filter just specify ports the SMBv1 is using (137,138,139,445) and submit. Then all resources(Top xxx Applications, Top xx Conversations ...) on summary page will display filtered data for SMBv1 and you can drill down from summary page…

Hello, The time range has to be modified inside SWQL query. There is also possible to filter only specific IP Group but again only inside the custom query. Please loot at new report at…

Hello Bobsure, The report was modified to run on NTA 4.4 and higher. There is 7 days default time range used inside the report so that's why it probably timeout due to too much of stored flow data. Please let me know if you need more info. Regards Radekn

Hi, Second chart has different granularity on time axis so the speed is calculate for for bigger time chunk. I can see on the first chart there are two spikes. Those are aggregated together on second chart because granularity has bigger time chunks so calculation is giving you smaller speed. You may specify smaller range…

Hello, Will report below help? https://thwack.solarwinds.com/t5/NPM-Documents/95th-Percentile-Bandwidth-Utilization-using-Netflow-IPGroups/tac-p/526801 Regards Radek

Hi Matt, Yes, You are correct. The top talkers optimization writes into DB 95% of all traffic (IPgroup 1+IPgroup2+..+IPgroupN).So to have top talkers on 100% will be correct in the case of executing 95% Percentile report. Please let me know any other questions. Regards Radek

Hi Mattyo, Yes this is accurate, it computes daily averages in low order and from top 95 percent it pick the maximum value. By default( with top talker optimization 95%) the daily collapsed data shows 95 percent traffic in DB, I did not consider that before. So with this default option the 95% report will display max of…

Hi Mattyo,In case You want to compare NTA 95th report with NPM 95th report there will be discrepance because in case you have 95 top talker optimization set to value other then 100. By default it is set to 95 percent. This feature does improve performance by storing only most significant traffic.see also…

 Hi Mattyo, Reports are using 24h interval for bandwith utilization therefore data to last date (23:59 PM of previous date) are the last data included in report. However NPM 95th percentile report is including today’s data. When compare the NTA 95th report data with NPM 95th report modify the end date of NPM report to same…

Hi Mattyo, Reports will display only IPgroups which are enabled for display in TopXX IP Adress Groups Resourse. The "Enable display in Top XX IP Address Groups resources" choice in "Edit IP Address Groups" view has to be enabled. You can go there via "Netflow Settings/IP Address Groups/Manage IP Address Groups" Please let…

Hi Mattyo, I modified reports with new parameters InterfaceIDs,GroupIDs. Multiple filter values are identified as comma separated value. Parameter @ConversationIPs is using comma separated values as well. So for example to filter report by Your IP groups it will looks like this SET @GroupIDs= ' Group 1 - web servers,Group…

Hi Mattyo, For this report there was used IP groups report which puts Source IPs and Destination IPs together by definition. This does not separate received and transmitted traffic to IP group but it display total traffic=(Received + Transmitted) by IP address group per interface with specific interfaces flow direction…

Hi Mattyo,Can you send me example screenshot (NTA web page) with is asymmetric traffic, please?ThanksRegards Radekn

Hi Mattyo, Yes this is a bug of the report. I fixed it and attached new version of the report. I also added maximum 95th percentile ( the percentile of maximum values from both Ingress and Egress traffic ) Please let me know other questions You have. thanks Regards radekn…