Just installed the eval NTA2.1 and hotfixes last week. So far I don't like it.
1. I would like to see a view that showed something like the Top XX converstations on the network or device, not just down at the Netflow endpoint level. Also not just tied to one node, but the Top XX conversation on whatever link I want to look at. I could then pick a conversation and drill down into it finding out what sort of traffic etc.
2. In Node Details, I would like the choice to show Top XX Recievers. The only option I see is Endpoints. I would rather see who or what machines/devices on my network are creating the most traffic, then I could click on it and see the endpoints.
3. In netflow settings I only select the interface I want to see on a non cisco device, but on the Netflow Traffic Analysis Summary page under Netflow Sources I see all the interfaces. This seems to happen on our Riverbed appliances. Cisco devices show only those selected. If I remove those interfaces in system manager, then they go away in netflow. The draw back to this is I can't have just up/down on that interface without it also showing up in netflow. I haven't tested other non-cisco devices.
4. When looking at graphs, the X & Y scales are really hard to read. It is like taking an image and using html to down size it causing text and lines to become jagged. I have click on through to the custom chart to be able to read it.
5. Cisco VLAN icon shows a "?". Shows up this way in Orion too though, but I think Vlans are pretty common these days and some sort of icon could be used.
6. One thing I am not getting for example: I see an interface on a router shoot up to 1.27mb. This is a T1, so around 80%. So I want to see what is causing it. I click on that interface from the main page. Now I am looking at that interface's details at the default 15 minute setting. Top 5 Protocols show TCP 59.84Mb. My top endpoint is showing a server with a total bytes of 5.58Kb. I would think whatever system is causing the high traffic would be at the top. I change it to Last 5 minutes. TCP is now 19Mb and top endpoint is a server showing 9.71Kb for total. It just doesn't seem right to me. Ok, so I go back to the beginning, NTA home page - interface with high util and look at the Top 5 Endpoints. I then click the Interface again at the top of the page and it takes me to a node details page with a totally different set of top X endpoints. It should be the same point I was just looking at.
Overall at this point I think the info I am getting from NTA is just confusing and/or possibly wrong or should I say presented to me wrong. Maybe it is because I am left handed :).