Submit a ticketCall us

Webinar: Web Help Desk for HR, Facilities and Accounting Departments
This webinar will focus on use cases for HR, Facilities and Accounting.

Having a unified ticketing and asset management system for all the departments in your company can provide end-users with a seamless experience and make things easier for your IT team. Yet, with different business tasks and objectives, many departments don’t fully understand the capabilities of Web Help Desk and how the software can be customized for effective use in their departments.
Register Now.

Home > Success Center > Netflow Traffic Analyzer (NTA) > NTA shows Data Not Available

NTA shows Data Not Available

Updated March 11th, 2016

Overview

NTA shows "Data Not Available" in all resources for some or all devices.  Last Received Netflow time stamp can show a current time stamp and still show no data. If the Time stamp shows "Never"  the device/s are not configured correctly in order for the flow data to be processed or the flow data is not reaching the Netflow collector.  If the time stamp shows a current time stamp but still not showing any data there is an issue with either the Netflow Flow Storage database or with the Netflow service not able to process the data.

Environment

  • NTA 4.x - Any version
  • NPM - Any version
  • Server 2008 - Server 2012

Cause 

No Flow data can occur because of storage problems or because flows are not sent from the device to the Orion collector.

SQL information set in the NTA Flow Storage Configurator is not set correctly or pointing to an old database that is no longer used and a connection cannot be established.

 

Netflow Storage database has become corrupt and new flows are not able to be stored

 

Netflow service is unable to establish a connection to the Flow Storage database

 

NetFlow Collector Services provides status information about current Flow collectors. By default, Orion NTA listens for Flow data on port 2055, but some Flow‑enabled devices, including some Nortel IPFIX‑enabled devices, send Flow data on port 9995 and sFlow default port is 6343.

Resolution(s)

NTA Storage Problem when unable to connect to SLQ

  1. Locate the NTA Flow Storage Database under Settings > NTA Settings > Database Settings.
  2. Go to the NTA Flow Storage Database server and open the NTA Flow Storage Configuration application. 
  3. Test the SQL Connection.
  4. Update the SQL information so the database can be selected. 
  5. Click OK for the application to restart the service and sync the database. 

Flow Data Missing

Explanation:
In case your Flow‑enabled device configuration requires status information about current Flow collectors, the following procedure resets or adds Flow collection ports on which your Orion NTA collector listens for Flow data. You can also delete a collector, if necessary.

 

Notes:

  • If you are employing a firewall on your NetFlow collector, all ports on which the NetFlow collector listens for Flow data should be listed as firewall exceptions for UDP communications.
  • If you delete all collectors, you must either run the Configuration Wizard again to restore your initial settings or provide another collector from a different Orion poller.

 

  1. Click Start > All Programs > SolarWinds Orion > NetFlow Traffic Analyzer > NetFlow Web Console.
  2. Log in using a User ID with a Solarwinds account with  administrative privileges.
  3. Click Settings in the top right corner of the Web Console.
  4. Click NTA Settings in the Settings grouping of the Orion Website Administration page.
  5. Click NetFlow Collector Services.
  6. If you want to add or reset a collection port, type the new port number in the Collection Port(s) field of the collector that you want to edit.
    • Separate listed ports with a single comma, as in 2055,9995.
    • A colored icon displays your collector status visually. Green indicates that the collector can receive Flow data, and red indicates that it can not. Server Name provides the network identification of your collector, and Receiver Status is a verbal statement of collector status.
  7. If you want to delete a collector, click Delete.
  8. Click Submit when you finish configuring your NetFlow collectors.
NTA Flow Storage Database is Out of Space
  1. Open NTA Flow Storage Database Configurator. 
  2. Check the path. 
  3. Check Hard drive for space. 
  4. Add more disk space., 
  5. Run the NTA Flow Storage Database Configurator to resume data in the resources. 
NTA Data Not Available, but Flows are coming into the Collector (Remote Flow Storgae)

Firewall and Group policy blocking ports 17777, which is needed to store flows in the database and displaying data in the Wen Console. 

NTA Data Not Available, but Flows are coming showing in Wireshark, but not in Performance Monitor
  1. Run Performance Monitor on the server and load the Netflow counters:
  2. Select the view to Report and you should see packets coming in for Netflow:
  3. If nothing was showing here and you can see flows are coming into Wireshark and the packets have the required fields. Then the Firewall on the server is turned on. 
  4. Either turn off the firewall or create a Firewall inbound rule to allow traffic for the port that is being used to listen ex: 2055. 

Wireshark filters and links to Troubleshooting with Wireshark:

Wireshark Operators

Operator
Wireshark Command
equals ==
or ||
and &&

NPM Filters

What you are looking for
Wireshark Filter
SNMP traffic using a specific community string: snmp.community == "public"
SNMP traffic NOT using a specific community string: snmp and !(snmp.community == "public")
All traffic to/from the specified target ip.addr==192.168.1.254 
All ICMP (ping) traffic icmp
All SNMP traffic snmp
Specific SNMP OID traffic snmp.name==1.3.6.1.2.1.2.2.1.2.11111 
Specific SNMP traffic containing an OID string snmp.name contains  1.3.6.1.2.1.2.2.1.2.11111 
Specific SNMP OID traffic from a particular IP address ip.addr==192.168.1.252 and snmp.name==1.3.6.1.2.1.2.2.1.2.11111
All traffic on UDP port 161 (typically just SNMP) udp.port==161

NTA Filters

What you are looking for
Wireshark Filter(s)
All NetFlow data arriving on the box

cflow

NetFlow data arriving from a particular IP ip.addr==1.2.3.4 and cflow
All traffic on the default NetFlow port udp.port==2055
JFlow and SFlow traffic udp.port==9995
NetFlow data - specific endpoint source

cflow.srcaddr == 1.2.3.4

NetFlow data - specific endpoint destination

cflow.dstaddr == 1.2.3.4

NetFlow on a specific vlan cflow.vlanid==1
NetFlow Endpoint destination port cflow.dstport == 1234
NetFlow Endpoint source port cflow.srcport == 1234
NetFlow Input interface (ifindex of 15 in this example) cflow.inputint == 15 
NetFlow Output interface (ifindex of 15 in this example) cflow.outputint == 15 
sFlow source ip.src==1.2.3.4 and sflow

 

Last modified
13:21, 14 Aug 2017

Tags

Classifications

Public