NTA drops NetFlow v9/IPFIX flows with “Missing mandatory fields: Bytes (1) or OutBytes (23) or Bytes (85) or InitiatorOctets (231) or ResponderOctets (232)” in NTA Business Layer log

Problem / Symptoms

• NetFlow/NSEL/IPFIX data from one or more devices (often firewalls such as Cisco FTD/ASA, SD-WAN, or routers) is not visible in SolarWinds NTA:
  • “Last Received NetFlow” shows Never or an old timestamp.
  • NTA resources show no conversations, no top talkers, or incomplete traffic for specific devices, while other devices work.
• Packet captures on the SolarWinds collector show NetFlow v9/IPFIX/NSEL traffic arriving on the expected UDP port (for example, 2055), but no flows appear in the NTA web console.
• NTA is otherwise functioning; other exporters send flows that NTA displays correctly.

Exact error message in logs

In NTA.BusinessLayer.log you see entries similar to:

Template contains fields: …
Missing mandatory fields: Bytes (1) or OutBytes (23) or Bytes (85) or InitiatorOctets (231) or ResponderOctets (232)

(Template IDs and field lists vary by device, but the “Missing mandatory fields…” line is consistent.)

What this article explains

• What this log message means for NTA and why flows are not displayed.
• How to confirm the issue using NTA logs and packet captures (Wireshark).
• Why this cannot be fixed in NTA and must be addressed on the device/exporter side.
• What changes are required on the exporter (flow record/profile/template) and what options you have if the device cannot be changed.

SolarWinds NTA enforces a required-fields schema for NetFlow v9/IPFIX/NSEL templates (see “Required fields in SolarWinds NTA”). Each flow template must include:

• Protocol
• Source address (IPv4/IPv6)
• Destination address (IPv4/IPv6)
• At least one Interfaces group field:
  • InterfaceRx – Field Type 10 (SNMP ingress interface index), or
  • InterfaceTx – Field Type 14 (SNMP egress interface index)
• At least one Bytes group field (this article’s focus):
  • Bytes – Field Type 1 (delta bytes), or
  • Bytes – Field Type 85 (total bytes), or
  • OutBytes – Field Type 23, or
  • InitiatorOctets – Field Type 231, or
  • ResponderOctets – Field Type 232

Root cause

• The affected device (exporter) is sending NetFlow v9/IPFIX/NSEL templates that do not include any Bytes-group field (none of IDs 1, 23, 85, 231, 232 are present in those templates).
• When NTA decodes such a template, it logs “Missing mandatory fields: Bytes (1) or OutBytes (23) or Bytes (85) or InitiatorOctets (231) or ResponderOctets (232)” and drops all flows that use that template.
• Other templates from the same exporter that do include a Bytes-group field (for example, those containing initiatorOctets (231) and responderOctets (232)) are accepted; the problem affects only the templates missing these fields.

This behavior is by design and consistent across NTA versions; it is not a regression caused by an upgrade, migration (including to Azure), or configuration change on the SolarWinds side.

Important: This issue cannot be fixed in NTA. There is no setting, hotfix, or unsupported configuration that safely bypasses the required-fields schema. The resolution is always on the exporter/device side.

Step 1 – Confirm the issue

1. Check NTA Business Layer log

   • On the SolarWinds server, open NTA.BusinessLayer.log (from Orion/Platform diagnostics).
   • Search for:

     Missing mandatory fields: Bytes (1) or OutBytes (23) or Bytes (85) or InitiatorOctets (231) or ResponderOctets (232)

     text

      

   • Note the exporter IP address and Template ID mentioned in nearby lines (Template contains fields: …).

2. Validate template content in Wireshark (optional but recommended)

   • Capture NetFlow v9/IPFIX/NSEL traffic on the SolarWinds collector (UDP port, e.g., 2055).
   • Open the pcap in Wireshark and decode as cflow if needed.
   • Filter for template packets:

     cflow.template_id

     text

      

   • For a template from the affected exporter:

     • Expand Cisco NetFlow/IPFIX → Template FlowSet (Id = 0) → Template (Id = X).
     • Review the Field Type IDs.
     • Confirm that none of the Bytes-group IDs (1, 23, 85, 231, 232) appear.

Step 2 – Change the exporter configuration (device/vendor side)

Work with the device vendor (for example, Cisco TAC for FTD/ASA, SD-WAN vendor, router vendor) to ensure:

• At least one template that NTA should consume includes all mandatory fields, including one of the Bytes-group fields listed above.
• This typically involves:
  • Adjusting the NetFlow v9 / Flexible NetFlow / NSEL / IPFIX record or profile to collect a bytes/octets counter.
  • Ensuring the active policy/class map for the traffic sent to SolarWinds uses that record/profile.
  • In some platforms, upgrading to a firmware/software version that supports an appropriate record type.

Once the exporter sends a compliant template, NTA will stop logging “Missing mandatory fields…” for that Template ID and will store flows using that template.

Step 3 – If exporter cannot be changed

If the vendor confirms that the current device/platform/version:

• cannot add any of the Bytes-group fields (1, 23, 85, 231, 232) to its NetFlow v9/IPFIX/NSEL templates,

then:

• This is a device limitation, not a SolarWinds defect.
• NTA will continue to drop flows from those templates.
• Options:
  • Use NTA for other exporters that meet the required-fields schema.
  • Use SNMP, syslog, or security/event tools for visibility into that device’s traffic instead of flow data.
  • Optionally, request an enhancement via their SolarWinds account team for NTA to evaluate support for those specific non-standard templates (no guarantees and long-term only).