Documentation forNetFlow Traffic Analyzer
Analyzing network traffic and bandwidth is a key capability of SolarWinds Observability Self-Hosted (formerly Hybrid Cloud Observability) and is available in the Advanced edition. NetFlow Traffic Analyzer (NTA) is also available in a standalone module.

NetFlow Interface Details

Under NetFlow Sources, expand a router name, and then click an interface to open the NetFlow Interface Details view.

Top 5 Endpoints

This widget provides a view of the endpoints producing the most traffic over the selected interface. The table below the chart provides the name or IP address of each listed endpoint, the amount of traffic from each listed endpoint, in both bytes and packets, and the percentage of all traffic over the viewed interface that is traceable to each listed endpoint. Click an endpoint to open the NetFlow Endpoints Summary view.

Top 5 Protocols

This widget provides a view of the traffic protocols the viewed interface sees most. The table below the chart provides the protocol type, the amount of data, the total number of packets, and the percentage of all traffic over the viewed interface using each listed protocol.

Top 5 Types of Service

This widget provides a quick view of the services most actively employed by the viewed interface. The table below the chart provides the type of service, the amount of traffic in bytes and packets that is handled by the service over the viewed interface, and the percentage of all serviced traffic over the viewed interface that is handled by the selected type of service.

CBQoS Pre-Policy Class Map

If you are viewing a CBQoS-enabled interface to which a CBQoS policy is currently applied, this widget displays the classes of traffic traversing the viewed interface. For each class of defined traffic, the table below the chart reports the average and most recently polled interface utilization values as a percentage of total defined interface bandwidth as measured before any traffic-shaping CBQoS policy is applied on the viewed interface.

CBQoS Drops

If you are viewing a CBQoS-enabled interface to which a CBQoS policy is currently applied, this widget displays the amount of traffic traversing the viewed interface that is dropped as a result of CBQoS policy application. For each class of defined traffic, the table below the chart reports the average and most recently polled interface utilization values as a percentage of total defined interface bandwidth corresponding to the amount of traffic that is dropped as a result of CBQoS policy application.

Top 5 Conversations

This widget provides a list of conversations creating the most traffic over the viewed interface. For each conversation, this widget reports the amount of data transferred in the conversation and the percentage the listed conversation represents of the total data transferred over the viewed interface. Click a conversation to open the NetFlow Conversations Summary view.

Top 10 Domains

This widget provides a view of the domains producing the most traffic on the selected interface. The table below the chart provides the domain name, the amount of traffic in bytes, the total number of packets communicated, and the percentage of all traffic on the selected interface that is traceable to each domain.

This widget is only available if persistent DNS resolution is enabled. On evaluation installations, DNS resolution is set to persistent by default. For more information, see Configuring DNS and NetBIOS Resolution in the SolarWinds NetFlow Traffic Analyzer Administrator Guide.

Top 10 Applications

This widget provides a quick view of the applications used most by the viewed interface. The table below the chart provides the application name, the amount of data that is flowing, the equivalent total number of packets, and the percentage of all traffic that is traceable to use of the listed application by the viewed interface. Click an application to open the NetFlow Applications Summary view.

CBQoS Post-Policy Class Map

If you are viewing a CBQoS-enabled interface to which a CBQoS policy is currently applied, this widget displays the classes of traffic traversing the viewed interface. For each class of defined traffic, the table below the chart reports the average and most recently polled interface utilization values as a percentage of total defined interface bandwidth as measured after any traffic-shaping CBQoS policy is applied on the viewed interface.

CBQoS Policy Details

If you are viewing a CBQoS-enabled interface to which a CBQoS policy is currently applied, this widget displays the applied traffic policies, corresponding defined traffic classes and nested policies on the viewed interface. For each defined traffic class, this widget provides the amount of traffic and corresponding percentage of total defined interface bandwidth over both the last hour and the last 24 hours.

Top 5 Traffic Destinations by Domain

This widget provides a chart and table of the domains hosting destinations of traffic from the selected interface, ranked by percentage of total traffic. The table below the chart provides the name of the domain to which traffic is routed, the amount of traffic routed to servers in the listed domain, and the percentage of all routed traffic from the viewed interface that is routed to servers in the listed domain.

Top 5 Traffic Sources by Domain

This widget provides a chart and table of the domains hosting sources of traffic from the selected interface, ranked by percentage of total traffic from the selected interface. The table below the chart provides the name of the domain to which traffic is routed, the amount of traffic routed to servers in the listed domain, and the percentage of all routed traffic from the viewed interface that is routed to servers in the listed domain.

Top 5 IP Group Conversations

This widget provides a chart and table of the conversations generating traffic from the selected interface, ranked by percentage of total traffic. The table below the chart provides the name of the IP Group to which traffic is routed, the amount of traffic routed to servers in the listed IP Group, and the percentage of all routed traffic from the viewed interface that is routed to servers in the listed IP Group.