Submit a ticketCall us

whitepaperYour VM Perplexities Called, and They Need You to Read This.

Virtualization can give you enormous flexibility with future workloads and can be a key enabler for other areas, like cloud computing and disaster recovery. So, how can you get a handle on the performance challenges in your virtual environment and manage deployments without erasing the potential upside? Learn the four key areas you need to be focusing on to help deliver a healthy and well-performing data center.

Get your free white paper.

Home > Success Center > Netflow Traffic Analyzer (NTA) > NTA - Knowledgebase Articles > NTA reports a higher bandwidth utilization than the threshold value

NTA reports a higher bandwidth utilization than the threshold value

Created by Brian O'Donovan, last modified by Daniel Polaske on Mar 10, 2017

Views: 2,268 Votes: 2 Revisions: 12

Overview

NTA reports a higher bandwidth utilization than the threshold for the interface. Also, the reported bandwidth utilization is higher than that of NPM. For example, 100Mbps interface reporting spikes of up to 1Gbps in NTA.

Environment

All versions of NTA

Cause 

This is caused by a misconfigured device (router) that exports the NetFlow data summaries for long recorded conversations instead of  sending those exports evenly over time.

Resolution

  • If you are using standard NetFlow v9, add the following command to your Cisco router:

ip flow-cache timeout active 1

  • If you are using Cisco v5, add the following commands to your Cisco router:

ip flow-cache timeout active 1

ip flow-cache timeout inactive 15

  • If you are using Cisco Flexible Netflow, which based on Netflow v9 add the commands below to te "Flow Monitor"

           cache timeout inactive 10

    cache timeout active 1

  • The Flow Monitor configuration will look like the entry below:
    • flow monitor NetFlow-Monitor
       description Original Netflow captures record ipv4
      exporter NetFlow-to-Orion
      cache timeout inactive 10
      cache timeout active 1
  • If you are using a Cisco ASA running IOS 9.1.2 or higher this command should be available to correct this:

 

flow-export active refresh-interval 1
 

  • Other ASA settings to validate:

 

ip flow-export delay flow-create 60 

ip flow-export template timeout-rate 1

 

 

Last modified

Tags

Classifications

Public