2 Replies Latest reply on Sep 30, 2015 2:13 AM by ronktn

    Netflow interface details not equal to traffic out

    ronktn

      Hello,

       

      Relatively new to the whole Solarwinds setup. Just installed NTA, and started monitoring all interfaces on a L3 switch we have.

      Configured sFlow on it. When I check my Traffic in on each individual interface, for example on port 1/0/37 I always see an average traffic of about ~200-300Kbps:

       

      However, when I click this interface to check the details, for my top endpoints I only receive a maximum of 20Kbps. I should expect this to be exactly the same to the 253kbps I saw before?

       

      Does anyone have an idea why this doesn't match?

       

      Thank you,

      Kind regards,

       

      Ron

        • Re: Netflow interface details not equal to traffic out
          Craig Norborg

          Well, Netflow is a bit tricky at times, although I definitely think from what you're saying that there is a problem here.   Knowing more details such as what type of equipment your monitoring and how its configured might help.

           

          My initial guess would be that your only seeing traffic that is being switched by the processor, what types of traffic are you seeing?   Is it all types of traffic or mainly things like SNMP, SSH or routing protocols to the switch itself?   If so, you might have to tweak how Netflow or SFlow is configured on the switch in order to see the layer2 switched traffic.  On a Cat6500 this would be done with the "ip flow layer2-switched" or the "ip flow ingress layer2-switched vlan XX" commands.   Of course your equipment has to support monitoring of L2 switched flows vs. just L3 flows.

           

          Its also possible that a majority of the flows are traffic types that are being ignored by Solarwinds, which will drop packet types that it doesn't recognize by default.  If you go into your "Settings" and then "NTA Settings", near the top you'll see "Enable data retention for traffic on unmonitored ports".  This will enable >everything< to be monitored, not just recognized traffic types and is not the best way to handle this, see the next paragraph for the best way.   But, on the same line it should say "X of Y PDU(s) have been received from unmonitored port(s)".   X should be a small fraction of Y, if it is then this is not your problem.   If X is large, that means lots of packets are being discarded.    Note:  This approach can raise your CPU or the amount of data retained by quite a bit.

           

          Another approach, instead of monitoring all ports like above, is right below that where you can choose the applications and ports that you want to monitor, under "Application and Service Ports".   In here you can see all the recognized types of traffic that Solarwinds knows about.   Everything with a green checkmark that says "Monitored" is being monitored and not discarded.     From here you can enable all monitoring of all the recognized traffic types, this is different than the last solution which enables it for both recognized and not recognized traffic.   You can also make your own definitions for traffic type if your applications are using ports that are not listed here.

           

          Let's see if any of this helps!!