Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Netflow Traffic Analyzer (NTA) > NTA reports a higher bandwidth utilization than the threshold value

NTA reports a higher bandwidth utilization than the threshold value

Created by Brian O'Donovan, last modified by Daniel Polaske on Mar 10, 2017

Views: 310 Votes: 1 Revisions: 12

Overview

NTA reports a higher bandwidth utilization than the threshold for the interface. Also, the reported bandwidth utilization is higher than that of NPM. For example, 100Mbps interface reporting spikes of up to 1Gbps in NTA.

Environment

All versions of NTA

Cause 

This is caused by a misconfigured device (router) that exports the NetFlow data summaries for long recorded conversations instead of  sending those exports evenly over time.

Resolution

  • If you are using standard NetFlow v9, add the following command to your Cisco router:

ip flow-cache timeout active 1

  • If you are using Cisco v5, add the following commands to your Cisco router:

ip flow-cache timeout active 1

ip flow-cache timeout inactive 15

  • If you are using Cisco Flexible Netflow, which based on Netflow v9 add the commands below to te "Flow Monitor"

           cache timeout inactive 10

    cache timeout active 1

  • The Flow Monitor configuration will look like the entry below:
    • flow monitor NetFlow-Monitor
       description Original Netflow captures record ipv4
      exporter NetFlow-to-Orion
      cache timeout inactive 10
      cache timeout active 1
  • If you are using a Cisco ASA running IOS 9.1.2 or higher this command should be available to correct this:

 

flow-export active refresh-interval 1
 

  • Other ASA settings to validate:

 

ip flow-export delay flow-create 60 

ip flow-export template timeout-rate 1

 

 

Last modified

Tags

Classifications

Public