Search 85,791 posts and 651 resources contributed by 43,443 members or post a topic.

Already Joined? Sign in
NTA agreement with router Netflow information

Page 1 of 1 (8 items) | RSS

rated by 0 users
Answered (Verified) This post has 2 verified answers | 7 Replies | 0 Followers | 639 Views


129 Posts
Points 460
jswan posted on Thu, Jun 18 2009 11:47 AM
rated by 0 users

I have a large flow moving through a router:

RouterX#sh ip flow top

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP Bytes
Se0/0:1       216.235.91.31   Fa0/0.134     10.x.y.z   06 0050 0C01    28M

However, if I search for the public IP address in NTA, it shows up only on the next hop router upstream from RouterX, not on router X itself, despite the fact that I have both "ip flow ingress" and "ip flow egress" configured on the serial interface for router X.

Any idea what's wrong here? It seems to me that I should see this traffic in Orion NTA on RouterX as well.

NPM 9.5 SP4, NTA 3.6, APM 3.1, NCM 5.5.2

  • | Post Points: 3

Answered (Verified) Verified Answers


129 Posts
Points 460
Answered (Verified) jswan replied on Thu, Jun 25 2009 5:24 PM
rated by 0 users
Verified by jswan

The problem turned out to be in the NPM module instead of the NTA module. I had all of the interfaces selected in the NTA configuration, but in the NPM configuration only the physical interface was monitored, not the FastEthernet subinterfaces. This caused the NTA statistics for the serial interface to be incorrect because the software didn't know what to do with the FastEthernet subinterface indexes in the Netflow packets. So the moral of the story is to have all interfaces that packets traverse monitored in both NTA and NPM.

NPM 9.5 SP4, NTA 3.6, APM 3.1, NCM 5.5.2

  • | Post Points: 23

2,547 Posts
Points 25,412
Moderator
SolarWinds Employee
Answered (Verified) chris.lapoint replied on Tue, Nov 3 2009 4:06 PM
rated by 0 users
Verified by chris.lapoint

FYI, one option to consider is navigating to NTA settings area and enabling "Allow monitoring of unmanaged interfaces".   This way if at least one of the interface indexes in the received flows maps to an Orion managed interface, NTA will accept the flow data

Chris LaPoint, Sr. Product Manager
SolarWinds
Austin, TX

  • | Post Points: 21

All Replies


129 Posts
Points 460
jswan replied on Thu, Jun 18 2009 12:40 PM
rated by 0 users

I'd add to this that if I look in the "Today" view in NPM, it shows that I've transferred several hundred megabytes across the serial link, but the NTA interface detail shows less than 2 megabytes transferred. Something doesn't add up here...

NPM 9.5 SP4, NTA 3.6, APM 3.1, NCM 5.5.2

  • | Post Points: 3

1,272 Posts
Points 14,285
Moderator
SolarWinds Employee
mcbridea replied on Thu, Jun 18 2009 1:06 PM
rated by 0 users

Can you post a screen shot of what you are seeing?

Andy McBride, Technology Support Specialist - SolarWinds

Follow Me on Twitter

  • | Post Points: 3

129 Posts
Points 460
jswan replied on Thu, Jun 18 2009 3:27 PM
rated by 0 users

Here's the bytes transferred from NPM:

 

 

And here's the interface details from NTA:

 

 

 

The interface detail diagram looks like it's showing only the control plane packets.

NPM 9.5 SP4, NTA 3.6, APM 3.1, NCM 5.5.2

  • | Post Points: 1

278 Posts
Points 2,466
SolarWinds Certified Professional
Thwack MVP
kweise replied on Fri, Jun 19 2009 6:58 AM
rated by 0 users

jswan,

Do you have your ip flow ingress and egress statements configured on the physical serial interface or on your sub-interface.   If you have sub-interfaces configured, it's been my experience that you won't see all your traffic unless you configure the ip flow statements on your sub interfaces.  You also have to monitor the sub-interfaces in Orion.

Hope this helps!

  • | Post Points: 3

129 Posts
Points 460
jswan replied on Fri, Jun 19 2009 9:29 AM
rated by 0 users

The serial interface has no subinterfaces; everything is configured on the physical interface (the ":0" in the interface name is due to the fact that it's a MFT-T1 card). I tried adding the ip flow commands to the FastEthernet subinterfaces too, but that doesn't make a difference.

NPM 9.5 SP4, NTA 3.6, APM 3.1, NCM 5.5.2

  • | Post Points: 1

129 Posts
Points 460
Answered (Verified) jswan replied on Thu, Jun 25 2009 5:24 PM
rated by 0 users
Verified by jswan

The problem turned out to be in the NPM module instead of the NTA module. I had all of the interfaces selected in the NTA configuration, but in the NPM configuration only the physical interface was monitored, not the FastEthernet subinterfaces. This caused the NTA statistics for the serial interface to be incorrect because the software didn't know what to do with the FastEthernet subinterface indexes in the Netflow packets. So the moral of the story is to have all interfaces that packets traverse monitored in both NTA and NPM.

NPM 9.5 SP4, NTA 3.6, APM 3.1, NCM 5.5.2

  • | Post Points: 23

2,547 Posts
Points 25,412
Moderator
SolarWinds Employee
Answered (Verified) chris.lapoint replied on Tue, Nov 3 2009 4:06 PM
rated by 0 users
Verified by chris.lapoint

FYI, one option to consider is navigating to NTA settings area and enabling "Allow monitoring of unmanaged interfaces".   This way if at least one of the interface indexes in the received flows maps to an Orion managed interface, NTA will accept the flow data

Chris LaPoint, Sr. Product Manager
SolarWinds
Austin, TX

  • | Post Points: 21
Page 1 of 1 (8 items) | RSS

© 2003 - 2010 SolarWinds, Inc. All Rights Reserved.

Who is SolarWinds?

SolarWinds is rewriting the rules for how companies manage their networks. Guided by a global community of network engineers, SolarWinds develops simple and powerful network management software and network monitoring software for networks of all sizes. SolarWinds also offers a network certification program to become a SolarWinds Certified Professional (SCP).

What is thwack?

thwack, SolarWinds online community site, was designed by network engineers, for network engineers. thwack is a vibrant, growing community of more than 30,000 IT pros who share a passion for technology.

Explore Resources, Answers, Templates, and Advice

Download Free Networking Tools

Learn More About SolarWinds Products