Submit a ticketCall us

Get a crash course on Network Monitoring delivered right to your inbox
This free 7-day email course provides a primer to the philosophy, theory, and fundamental concepts involved in IT monitoring. Lessons will explain not only how to perform various monitoring tasks, but why and when you should use them. Sign up now.

Home > Success Center > Netflow Traffic Analyzer (NTA) > Troubleshoot no data on a specific interface in NetFlow Traffic Analyzer

Troubleshoot no data on a specific interface in NetFlow Traffic Analyzer

Created by Con Finucane, last modified by Eric Bryant on Feb 08, 2017

Views: 162 Votes: 3 Revisions: 8

Overview

This article describes the issue when a port is monitored by NTA and the last received flow does not display any data. 

 

 

Environment

All versions of NTA

Cause 

This problem occurs when there is a device configuration issue.

Resolution

 

Troubleshooting Basic Interfaces:

 

1. Prepare a filter directly from the wireshark GUI.

a. Highlight one of the frames.

b. Find the filed you are looking for.

c. Expand Flow Set.

d. Expand Flow 1.

e. Right-click InputInt:3 > click Prepare a Filter > Selected.

This now add the Input Interface as the filter.

  2.  Modify the filter to include any interface Index you wish to filter on.

  3.  Get interface indexes id, use the interface table form the Solwarwinds Orion database.

Note:

  • If there are flows being received then they will appear here.
  • If the screen is blank after applying the filter, then the device is not configured correctly to send flows to the Orion Server.

 

Troubleshooting Tunnel Interfaces:

 

 

If no data is seen for tunnel interfaces. What can happen is tunneling is setup through several different interfaces and the last interface is sending the NetFlow data to the wrong SolarWinds server. 

 

Troubleshooting Virtual Interfaces:

 

If you add sub interfaces on a physical interface say a Palo Alto. In this case they will show up as Virtual interfaces. This will show up in the NTA events with the ifindex. Add this to start getting Netflow data in the NTA application. It will allow you to edit the name and interface speed for that Virtual interface. Run Wireshark to look at these ifindexes to sort this out in the NTA events to find the one you need to add.  

 

Check to see if any other interfaces are added with the same ifindex:  

It could be possible that another virtual interface was added previously with the same ifindex. If this happens you will not see flow information for the new interface you are trying to add with the same ifindex. You can find the ifindex from the NPM interface details page of the node/interface in question.

 

 

Last modified
10:46, 8 Feb 2017

Tags

Classifications

Public