5 Replies Latest reply on May 28, 2010 5:08 AM by GZhytar

    Netflow and Interface Utilization not matching

    pvaldes

      Hi,


      Im seeing some inconsistencies with my NPM 9.5.1 and NTA 3.6. See attached

      In the last 30 mins, NTA is showing traffic in KBytes but on my router as well as the Average bits p/s it is showing usage between the 2.5 to 3Mbits.

      The router is also on the top 10 Interfaces with High Percent Usage and Top 10 NetFlow Sources by % Utilization in the 70% mark. On the Solarwinds System Manager under Interface Details of the same WAN, received and transmit percent utilization is not accurate as well.

      Total bandwidth of WAN is 4Mbits.

      Any ideas?

        • Re: Netflow and Interface Utilization not matching
          GZhytar

          pvaldes,

          there could be several reasons why you don't see all data in you NTA. E.g. you are missing some traffic because not all interfaces are monitored by NTA.

          You know that each flow carries information about 2 interfaces -  Input(Ingress) and Output(Egress) (which is just SNMP indexes).

          To be able to store flow to the database, NTA requires at least one  of interfaces to be managed by NPM and monitored by NTA same time (I  agree that it sounds little bit more complicate that it actually is).

          When you receive flow where one interface is managed by NPM and  monitored  by NTA, second interface is not managed by NPM and option "Allow  monitoring of flows from unmanaged interfaces" in ON  - you will not  receive any warnings and flow will be saved to the database.

          When you receive flow from interface that managed by NPM and not  monitored by NTA and "Automatic addition of NetFlow sources" option  turned ON - this interface will be automatically added to NetFlow  sources and flow will be saved to the database.

          When you receive flow where both interfaces are not managed by NPM -  you will receive notification message and flow will be dropped as we  can't process it.

          So I would recommend you to check NTA options under NTA Admin settings:

           - Enable data retention for traffic on unmonitored ports - should be ON

           - Allow monitoring of flows from unmanaged interfaces  - should be ON

          If that won't help, please open support ticket (http://www.solarwinds.com/support/ticket/), so we can investigate your case in more details.

          thanks

          1 of 1 people found this helpful
            • Re: Netflow and Interface Utilization not matching
              pvaldes

              Hi Georgiy,

              Thanks for the quick response. I understand what you meant by 2 interfaces on each flow. Im currently monitoring the LAN interface but not the WAN interface. The reason for this is we need to know which endpoints inside the LAN is generating most of the traffic both in and outbound (mostly in as our traffic is more downloads).

              Enable data retention for traffic on unmonitored ports was on already

              Allow monitoring of flows from unmanaged interface set to enable as stated. Is it best to put ip route-cache flow command on the WAN interface as well?

              I will test this throughout today and will reply to this thread. If no changes, I will raise a ticket with SW.

              Thanks