Resolve unknown NetFlow traffic
If your devices export flows to the SolarWinds NTA receiver, but are not managed in SolarWinds NPM, or are not configured for monitoring in SolarWinds NTA, SolarWinds NTA cannot process the exported information. SolarWinds NTA informs you that it is receiving unknown traffic by displaying a message in the yellow information banner at the top of your SolarWinds NTA views.
Unknown traffic can be viewed either as individual events within the Last 25 Traffic Analysis Events resource or on the Last 200 Unknown Traffic Events view.
Unknown traffic can include traffic from unmanaged devices and unmonitored or unmanaged interfaces. The following sections introduce different unknown traffic types:
Traffic from unmanaged nodes or interfaces
Unmanaged objects are nodes or interfaces that are not managed in SolarWinds NPM. The devices export flows, but SolarWinds NTA cannot access the necessary data stored in the Orion SQL Database. You need to add these nodes and interfaces to SolarWinds NPM first. For more information, see Add flow-enabled devices and interfaces to the Orion database.
Traffic from unmonitored interfaces
Unmonitored interfaces are interfaces managed in SolarWinds NPM, but not monitored by SolarWinds NTA. Traffic data from them are collected, but you cannot see them in SolarWinds NTA until you enable monitoring for them. For more information about monitoring flow and CBQoS sources in SolarWinds NTA, see Flow sources and CBQoS polling.
Traffic from unmonitored interfaces appears in SolarWinds NTA mainly if flow sources are not being added to SolarWinds NTA automatically. For more details, see Enable the automatic addition of flow sources.
Traffic from unmanaged interfaces
Unmanaged interfaces cannot be monitored using SNMP. However, SolarWinds NTA can receive traffic from these interfaces. SolarWinds NPM does not poll data for these nodes via SNMP, the nodes are only registered there and flows can be processed by SolarWinds NTA. However, to monitor this data in SolarWinds NTA, you must add the interface for monitoring to SolarWinds NTA, and provide the interface speed. For more information, see Enable flow monitoring from unmanaged interfaces.
If you cannot see an unknown traffic event concerning a device which should be exporting NetFlow, log on to the device and check the configuration. Make sure the device sends data to the appropriate port, which is 2055 by default.
Resolve unknown traffic events
- Click My Dashboards > NetFlow > NTA Summary.
- Check the yellow banner area below the tool bar.
- If there are unknown traffic events, click Show Unknown Traffic Events in the banner.
If you cannot see the banner, click NetFlow Settings, and then click Show Unknown Traffic Events under NetFlow Management.
- The Last 200 Unknown Traffic Events view lists the last 200 events related to SolarWinds NTA, including those in which flow traffic was received but was not associated with a NetFlow source.
- Resolve individual events.
Test whether the events were resolved
- On the Last 200 Unknown Traffic Events view, click Clear Notifications.
- Click Refresh Events. New events are added to the list, and unknown traffic events return to the list if they have not been resolved.
- You can also test resolving unknown traffic events by clicking My Dashboards > NetFlow > NTA Summary. You should no longer see a banner regarding unknown flow traffic. If you do, click the message and re-examine the Last 200 Unknown Traffic Events list again, repeating the steps in these procedures to resolve unknown traffic.