Submit a ticketCall us
Home > Success Center > Netflow Traffic Analyzer (NTA) > NTA shows Data Not Available

NTA shows Data Not Available

Updated March 11th, 2016

Overview

NTA shows Data Not Available in all the resources and all devices are still updating in real time to Last Received Netflow to current server time but there is no data displayed under resources.

Environment

  • NTA 4.1.0 - NTA 4.1.1
  • NPM 11.0.1 - NPM 11.5.2
  • Server 2008 - Server 2012

Cause 

No Flow data can occur because of storage problems or because flows are not sent from the device to the Orion collector. SQL information set in the NTA Flow Storage Configurator is being modified and a connection cannot be established.

NetFlow Collector Services provides status information about current Flow collectors. By default, Orion NTA listens for Flow data on port 2055, but some Flow‑enabled devices, including some Nortel IPFIX‑enabled devices, send Flow data on port 9995.

Resolution(s)

NTA Storage Problem

  1. Locate the NTA Flow Storage Database under Settings > NTA Settings > Database Settings.
  2. Go to the NTA Flow Storage Database server and open the NTA Flow Storage Configuration application. 
  3. Test the SQL Connection.
  4. Update the SQL information so the database can be selected. 
  5. Click OK for the application to restart the service and sync the database. 

Flow Data Missing

Explanation:
In case your Flow‑enabled device configuration requires status information about current Flow collectors, the following procedure resets or adds Flow collection ports on which your Orion NTA collector listens for Flow data. You can also delete a collector, if necessary.

 

Notes:

  • If you are employing a firewall on your NetFlow collector, all ports on which the NetFlow collector listens for Flow data should be listed as firewall exceptions for UDP communications.
  • If you delete all collectors, you must either run the Configuration Wizard again to restore your initial settings or provide another collector from a different Orion poller.

 

  1. Click Start > All Programs > SolarWinds Orion > NetFlow Traffic Analyzer > NetFlow Web Console.
  2. Log in using a User ID with a Solarwinds account with  administrative privileges.
  3. Click Settings in the top right corner of the Web Console.
  4. Click NTA Settings in the Settings grouping of the Orion Website Administration page.
  5. Click NetFlow Collector Services.
  6. If you want to add or reset a collection port, type the new port number in the Collection Port(s) field of the collector that you want to edit.
    • Separate listed ports with a single comma, as in 2055,9995.
    • A colored icon displays your collector status visually. Green indicates that the collector can receive Flow data, and red indicates that it can not. Server Name provides the network identification of your collector, and Receiver Status is a verbal statement of collector status.
  7. If you want to delete a collector, click Delete.
  8. Click Submit when you finish configuring your NetFlow collectors.
NTA Flow Storage Database is Out of Space
  1. Open NTA Flow Storage Database Configurator. 
  2. Check the path. 
  3. Check Hard drive for space. 
  4. Add more disk space., 
  5. Run the NTA Flow Storage Database Configurator to resume data in the resources. 
NTA Data Not Available, but Flows are coming into the Collector (Remote Flow Storgae)

Firewall and Group policy blocking ports 17777, which is needed to store flows in the database and displaying data in the Wen Console. 

NTA Data Not Available, but Flows are coming showing in Wireshark, but not in Performance Monitor
  1. Run Performance Monitor on the server and load the Netflow counters:
  2. Select the view to Report and you should see packets coming in for Netflow:
  3. If nothing was showing here and you can see flows are coming into Wireshark and the packets have the required fields. Then the Firewall on the server is turned on. 
  4. Either turn off the firewall or create a Firewall inbound rule to allow traffic for the port that is being used to listen ex: 2055. 

Wireshark filters and links to Troubleshooting with Wireshark:

Wireshark Operators

Operator
Wireshark Command
equals ==
or ||
and &&

NPM Filters

What you are looking for
Wireshark Filter
SNMP traffic using a specific community string: snmp.community == "public"
SNMP traffic NOT using a specific community string: snmp and !(snmp.community == "public")
All traffic to/from the specified target ip.addr==192.168.1.254 
All ICMP (ping) traffic icmp
All SNMP traffic snmp
Specific SNMP OID traffic snmp.name==1.3.6.1.2.1.2.2.1.2.11111 
Specific SNMP traffic containing an OID string snmp.name contains  1.3.6.1.2.1.2.2.1.2.11111 
Specific SNMP OID traffic from a particular IP address ip.addr==192.168.1.252 and snmp.name==1.3.6.1.2.1.2.2.1.2.11111
All traffic on UDP port 161 (typically just SNMP) udp.port==161

NTA Filters

What you are looking for
Wireshark Filter(s)
All NetFlow data arriving on the box

cflow

NetFlow data arriving from a particular IP ip.addr==1.2.3.4 and cflow
All traffic on the default NetFlow port udp.port==2055
JFlow and SFlow traffic udp.port==9995
NetFlow data - specific endpoint source

cflow.srcaddr == 1.2.3.4

NetFlow data - specific endpoint destination

cflow.dstaddr == 1.2.3.4

NetFlow on a specific vlan cflow.vlanid==1
NetFlow Endpoint destination port cflow.dstport == 1234
NetFlow Endpoint source port cflow.srcport == 1234
NetFlow Input interface (ifindex of 15 in this example) cflow.inputint == 15 
NetFlow Output interface (ifindex of 15 in this example) cflow.outputint == 15 
sFlow source ip.src==1.2.3.4 and sflow

 

Last modified
14:05, 9 Feb 2017

Tags

Classifications

Public