SolarWinds Network Traffic Analyzer (NTA) 4.0
Each network needs a different solution to the problem of how best to allocate a network’s precious bandwidth.
- The eternal problem: Our network is running slowly.
- The modern solution: Prioritize the traffic.
- Classic method: Set Class-Based Quality of Service (CBQoS).
- Tool for the job: SolarWinds Network Traffic Analyzer.
- Wireshark Response Time Viewer
Husbanding Your Network’s Bandwidth
Solarwinds Network Traffic Analyzer (NTA) works by capturing the flow data from network devices such as Juniper J-Flow, Cisco NetFlow v5 or v9.
The key feature is the ability of NTA to identify which users, applications, and protocols are consuming the most bandwidth from this stream of NetFlow data packets. Version 4.0's new net flow technology is particularly suitable for analyzing 'big data' generated by large organizations.
I Like the Way NTA Displays the Results in Top Ten Lists:
- Top 10 Nodes by Percent Memory Used.
- Top 10 Nodes by Current Response Time.
- Top 10 Nodes by Percent Utilization.
- Top 10 Nodes by Packet Loss.
- Top 10 Nodes by Average CPU Load.
- Top 10 Interfaces by Traffic.
How Traffic Analysis Works
The key technology involves NTA turning routers into traffic analyzers. Once you think about it you realize that the routers know an awful lot about network traffic, after all, controlling data packets is their day job. Solarwinds’ skill is not only providing the software for us to see the different types of layer 3 traffic, but also the ability to send important traffic through the router quickly at the expense of packets than can wait.
This diagram below of NTA an installation compares polling on Flow analysis with the CBQoS polling. The collection occurs simultaneously with Flow‑enabled devices using port 2055, whereas the CBQoS-enabled routers use port 161.
New Features in NetFlow Traffic Analyzer 4.0
Solarwinds has completely redesigned the flow storage system to cater for 'big data'. This is how version 4.0 has improved the NetFlow Traffic Analyzer:
- The database has a new, more flexible, NoSQL column-oriented option for storing flow data.
- By default, flow storage is increased from 15 to 30 minutes.
- More detail thanks to 1 minute data granularity during the whole retention period.
- Faster load times for NTA resources. You will find that v4.0 can process more flows per second.
- Reports are also faster and you can include custom tables.
- You no longer need Orion SQL, thus you can install the NTA Flow Storage Database on any computer in your network.
Strong Recommendations
To support the new flow storage, install NTA 4.0 on 64-bit hardware; 32-bit servers are not really suitable, furthermore support for this old hardware will be phased out soonish.
Where you employ the Orion SQL Database (most cases), install the NTA Flow Storage Database on a separate 64-bit server.
Note: End-of-life for 3.9 version. There will be no SolarWinds technical support for v3.9 after March 2015.
NTA v4 Issues with Previous Versions Fixed
- CPU performance problems with SQL
- 3.8 and 3.9 Upgrade problems
- Class Based Quality of Service (CBQoS) policy and polling issues corrected.
- A number of other minor but irritating issues have been fixed in V4.0.
SolarWinds NTA 4.0 Flow Monitoring
To truly understand the technology behind this new flow storage technology review this video by SolarWinds experts Lawrence Garvin and Patrick Hubbard.
Hardware Requirements for SolarWinds Network Traffic Analyzer
- CPU 3GHz or faster, dual processors with dual cores
- RAM 3GB or more
- Hard Drive Space
- Orion NTA server: 5GB or more, RAID 0, 1, 0+1, or 1+0.
- SQL Server: 5GB or more, RAID 0, 1, 0+1, or 1+0 on at least 6 spindles.
NetFlow Considerations
Naturally, each of these network devices needs to support SNMP.
- Cisco devices exporting NetFlow version 5 or 9.
- Huawei devices exporting NetStream version 5 or 9.
- IPFIX devices exporting IPFIX.
- J-Flow devices exporting J-Flow.
- sFlow devices exporting sFlow version 5.
Using Orion NTA’s Top Talker Feature
Many years ago Pareto discovered the 80:20 rule. 20% of users give 80% of the trouble! In the case of traffic monitoring, the top talkers should give the picture of who is using over 90% of your network bandwidth.
In addition to focussing your mind on the main consumers, the top talker feature significantly improves the responsiveness of the reporting pages. Any data lost will be of minor traffic that is unlikely to be the course of a network bottleneck that you may be investigating. You can review this feature in the NetFlow Web Console.
Orion Alerts Integration
NTA automatically adds top talker information to Orion interface utilization alerts. You can navigate directly in to the NTA interface details from messages in the Orion Events resource. For example, High Receive Percent Utilization: alerts you when traffic received by an interface exceeds the bandwidth threshold which you set earlier.
See my review of SolarWinds Orion NPM »
Prioritizing with Class-Based Quality of Service
The most enjoyably part of this tool is prioritizing traffic using data obtained by CBQoS (Class-Based Quality of Service); you can set the precedence on the basis of applications; alternatively you can weight the traffic based port numbers, or even prioritize based on users’ IP addresses. NTA gives you charts of which applications are being used by whom and for what purpose. One of this analyzers impressive features is that underneath each over-view is a drill-down into traffic on specific network elements.
One technique is to start with an intelligent guess as to the best priorities for traffic at the routers and switches. More than likely, you will tweak the priorities and repeat the cycle until you get the best trade-off for your network.
After you have spent time adjusting the NTA to suit your network you can sit back confident that you will get instant notification when an interface exceeds its utilization threshold. Since NTA stores the data you can look back and troubleshoot precisely when particular application traffic suddenly increased and caused a bandwidth problem.
CBQoS Alerts 
Class-Based Quality of Service was introduced in version 3.9. It monitors network traffic, and then reports on the effect of your prioritizing settings.
Pre-Policy
The Class-Based Quality of Service triggers an alert when the amount of Pre-Policy traffic meets the conditions of your threshold setting. It also writes to the SolarWinds event log and can email you a report of the network traffic.
Post-Policy
This enables you to make a before and after comparison of your settings. Again CBQoS triggers an event log entry and an email report if you wish. See chart to the right.
Drop Alerts
NTA with CBQoS even reports on data packets dropped as a result of the Post-Policy.
Thwack Forum
Here is a thriving group of people who are performing network management daily. Tap into their expertise, learn from their experiences; ask your questions and receive an expert answer quickly. Another use of the Thwack forum is for data sheets on how to configure your routers for use with NTA.
See also SolarWinds free Real-time Netflow Analyser »
Summary of Solarwinds Network Traffic Analyzer (NTA)
Run down your network bandwidth hogs with SolarWinds NTA, discover which applications are consuming the bandwidth.
Each network manager seeks a different solution to the problem of how to allocate their network’s bandwidth. With NTA you can turn your routers into traffic analyzers and then prioritize the data packets to ensure your computers are running at maximum efficiency.
More Free and Trial Network Software
Here are Guy’s reviews, recommendations and download links for additional handy utilities. Many of these programs are completely free, while others are fully-functional, but time limited. One common theme is that SolarWinds give you a free specialist tool ideal for testing, and then supply a more comprehensive suite for bigger networks. To let you into a secret, for small networks, the free tool is all you’ll ever need.
• Free Real-Time Network Monitor • Review SNMP Enabler • Review Network Traffic Analyzer
• Review of DameWare Mini Remote Control • DameWare Utilities • Diagnostic Tool for WSUS Agent
• Dameware Remote Support • SolarWinds LEM • Review of SolarWinds Patch Manager • Home
