Submit a ticketCall us

Get a crash course on Network Monitoring delivered right to your inbox
This free 7-day email course provides a primer to the philosophy, theory, and fundamental concepts involved in IT monitoring. Lessons will explain not only how to perform various monitoring tasks, but why and when you should use them. Sign up now.

Home > Success Center > Netflow Traffic Analyzer (NTA) > NTA reports a higher bandwidth utilization than the threshold value

NTA reports a higher bandwidth utilization than the threshold value

Created by Brian O'Donovan, last modified by Daniel Polaske on Mar 10, 2017

Views: 187 Votes: 1 Revisions: 12

Overview

NTA reports a higher bandwidth utilization than the threshold for the interface. Also, the reported bandwidth utilization is higher than that of NPM. For example, 100Mbps interface reporting spikes of up to 1Gbps in NTA.

Environment

All versions of NTA

Cause 

This is caused by a misconfigured device (router) that exports the NetFlow data summaries for long recorded conversations instead of  sending those exports evenly over time.

Resolution

  • If you are using standard NetFlow v9, add the following command to your Cisco router:

ip flow-cache timeout active 1

  • If you are using Cisco v5, add the following commands to your Cisco router:

ip flow-cache timeout active 1

ip flow-cache timeout inactive 15

  • If you are using Cisco Flexible Netflow, which based on Netflow v9 add the commands below to te "Flow Monitor"

           cache timeout inactive 10

    cache timeout active 1

  • The Flow Monitor configuration will look like the entry below:
    • flow monitor NetFlow-Monitor
       description Original Netflow captures record ipv4
      exporter NetFlow-to-Orion
      cache timeout inactive 10
      cache timeout active 1
  • If you are using a Cisco ASA running IOS 9.1.2 or higher this command should be available to correct this:

 

flow-export active refresh-interval 1
 

  • Other ASA settings to validate:

 

ip flow-export delay flow-create 60 

ip flow-export template timeout-rate 1

 

 

Last modified
17:40, 10 Mar 2017

Tags

Classifications

Public