Submit a ticketCall us

Systems Monitoring for Dummies
Our new eBook will teach you the fundamentals and help you create monitors and alerts that are effective, meaningful, and actionable. Monitoring is more than a checkbox on your to-do list. This free eBook will give you practical advice to help you succeed in all aspects of monitoring – discovery, alerting, remediation, and troubleshooting. Don’t miss out on this indispensable resource for newbies, experienced IT pros, and everyone in between. Register Now.

Home > Success Center > Netflow Traffic Analyzer (NTA) > Netflow data spikes instead of flowing evenly as expected transfer rate

Netflow data spikes instead of flowing evenly as expected transfer rate

Created by Daniel Polaske, last modified by MindTouch on Jun 23, 2016

Views: 277 Votes: 0 Revisions: 9

Overview

This article provides an example and brief information on Netflow data spike.

After the completion of a 30-minute 5GB download, you may inspect the NTA graphs and find that the download registered as a single 5GB download over the course of a minute which occurred at the end of the transfer, instead of a sustained 5GB download over 30 minutes at roughly 2.8MBps.  Visually, it appears as a spike instead of a block of traffic.

Environment

All Orion Core products with NTA installed

 

Cause 

This is typically due to the ip flow-cache timeout active setting on the exporting Cisco network device being set to a default of 30 or higher.

 

More details can be found by at the link from Cisco below for ip flow-cache timeout:

http://www.cisco.com/en/US/docs/ios/...html#wp1185203

Resolution

Change the global configuration to ip-flow-cache timeout active 1 instead of a higher value. 

This will force the device to export all flows on a minute-by-minute basis instead of exporting a flow only at the end of the conversation.  If assistance is needed with this change, we would kindly suggest for you to reach out to Cisco TAC as differences between make/model/IOS version.

 

 

Last modified

Tags

Classifications

Public