How many flows can NTA process when 'Top Talkers Optimization' is off

I don't think top talkers optimization affects the flows-per-second that NTA can process; rather it has to do with how much data is retained in the database. This in turn affects read performance from the database. If you turn it off, your read performance plummets if you have a lot of flows.

Some things you could try:

1) Turn off TTO and accept bad performance until you find the flow you're looking for, then turn it back on after you solve the problem.

2) Set TTO to 99% instead of the recommended 95% and see if the flow you're looking for can be found in the top 99%. My experience has been that a value of 98% or 99% still results in big performance gains versus turning it off.

This is an area where I really hope Solarwinds can make some big improvements in upcoming releases. The lack of full flow retention (with decent performance) and lack of access to raw flows makes the tool less than desirable for security and forensic work.

Hi jswan,

Thank you for reply. I understood how TTO works. By the way, do you know whether we can know how many flows does NTA receives?

Sure:

1. Open Windows Perfmon.
2. Click '+' to add a counter.
3. Select the Solarwinds NetFlow performance object.
4. Select the appropriate counter for your environment (probably "Netflow v5 Flows Received per Second").
5. Click "Add".