Documentation forNetFlow Traffic Analyzer
Analyzing network traffic and bandwidth is a key capability of SolarWinds Observability Self-Hosted (formerly Hybrid Cloud Observability) and is available in the Advanced edition. NetFlow Traffic Analyzer (NTA) is also available in a standalone module.

NetFlow Summary filtered view

Using the Flow Navigator, you can customize a filter that will enable you to display specified network traffic according to your needs.

  1. Click My Dashboards > NetFlow > NTA Summary.
  2. Click Flow Navigator on the left edge of the summary view. The Flow Navigator is available on any default NTA view.
  3. Under View Type, click Summary, and then select NetFlow Summary.

  4. Select the Time Period over which you want to view network traffic.

    • Select Named Time Period, and select a time period.
    • Select Relative Time Period, and provide a number appropriate for the selected time units. The relative time period is measured with respect to the time at which the configured view is loaded.
    • Select Absolute Time Period, and provide the start and end time periods.

  5. Select a Flow Direction.

    • Select Both to include ingress and egress traffic in the calculations NTA makes.
    • Select Ingress to include only ingress traffic in the calculations NTA makes.
    • Select Egress to include only egress traffic in the calculations NTA makes.

  6. You can also further limit the view by including or excluding some of the following items:

    If you want to limit your view to only display network traffic to and from applications, or to exclude traffic to and from them, expand Applications, and then complete the following steps:

    1. If you want to include traffic from specified applications, select Include.
    2. If you want to exclude traffic from specified applications, select Exclude.
    3. Enter the name of an appropriate application or the appropriate port number.
    4. If you want to include or exclude another application, click Add Filter, and then enter the name of the appropriate application.

    To only display network traffic to and from autonomous systems, or to exclude traffic to and from certain autonomous systems, expand Autonomous Systems, and enter the ID of an appropriate autonomous network. Click Add Filter.

    To only display network traffic related to specific autonomous system conversations, or to exclude traffic to and from them, expand Autonomous System Conversations, and enter IDs of autonomous systems involved in conversations. Click Add Filter.

    To only display network traffic related to specific conversations between two endpoints, or to exclude traffic to and from them, expand Conversations and enter the endpoints involved in the conversation. Click Add Filter.

    To only display network traffic related to specific countries, or to exclude traffic to and from them, expand Countries, and select a country to Include or Exclude.

    To select multiple countries, select each one and click Add Filter to apply each selection.

    To only display network traffic related to specific domains, or to exclude traffic to and from them, expand Domains, and enter the domain name you want to Include or Exclude.

    • To add multiple domains, enter a name and then click Add Filter to apply your selection after each entry.
    • If a domain name is not resolved and saved in NTA, you cannot use it in the Flow Navigator. In this case, NTA will prompt you for a valid name. For more information about resolving domain names, see Host and domain names in SolarWinds NTA

    To only display network traffic related to specific endpoints, or to exclude traffic to and from them, expand Endpoints:

    1. Enter the IP address or hostname of an appropriate endpoint to Include or Exclude.
    2. If you want to include or exclude traffic from a specified subnet, enter the appropriate range of IP addresses.

      You can either type in the range, for example 192.168.1.0-192.168.1.255, or use the CIDR notation, for example 192.168.1.0/24.

    3. If you want to include or exclude another endpoint, click Add Filter, and then enter the name of an appropriate endpoint.

    To only display network traffic related to specific IP address groups, or to exclude traffic to and from them, expand IP Address Groups, and then complete the following steps:

    1. Enter an appropriate IP address group.

      Though an IP Address Group is disabled, it may continue to appear in the list. As a workaround, rename the group before disabling it. For example, for an IP Address Group called PrimaryLAN, you might add _DISABLED to the end. An entry called PrimaryLAN_DISABLED indicates that the group is inactive.

    2. If you want to include or exclude another IP address group, click Add Filter, and then enter the name of an appropriate IP address group.

    To only display network traffic related to conversations between specified IP address groups, or to exclude traffic to and from them, expand IP Address Group Conversations:

    1. Select the IP address groups involved in conversations that you want to include or exclude.
    2. If you want to include or exclude another IP address group conversation, click Add Filter, and then enter the appropriate conversation IP address groups.

    To only display network traffic using specific protocols, expand Protocols and select the protocol to Include or Exclude.

    If you want to include or exclude another protocol, click Add Filter, and then select another protocol.

    To only display network traffic using specific service types, expand Types of Service and select an appropriate type of service to Include or Exclude.

    If you want to include or exclude another type of service, click Add Filter, and then select another type of service.

  7. Click Submit.
  8. If you want to save your custom filtered view for future reference, click Save Filtered View to Menu Bar.