Documentation forNetFlow Traffic Analyzer

Choose a predefined Traffic Path Analysis view

Traffic Path Analysis provides a set of predefined views. Each view defines a fixed set of dimensions and the order in which they appear in the chart. Most views are available in two alternatives: one using port-based Application classification, and one using NBAR2 deep packet inspection classification. The alternatives show the same relationship. They differ only in how traffic is classified into applications.

For information on understanding data in Traffic Path analysis views, see Reading the chart.

Select a view

  1. In the SolarWinds Platform Web Console, click My Dashboards > NetFlow > Traffic Paths.

  2. Click Recall View.

  3. In the list, select a view.

    A description of the view is displayed next to its name. If the view produces more useful results with a specific node selected, this is noted in the dialog.

  4. Click Load.

The predefined views are organized into the following categories:

  • Country conversations: Traffic between two countries

  • East-West conversations: Internal-to-internal traffic

  • North-South conversations: Internal-to-external traffic

  • Protocol conversations: Applications running on a given protocol

  • Unmonitored traffic: Traffic with no matching Application definition

  • Usage by IP Address Group: Application usage by site, VLAN, or tenant

  • Application composition: Full application mix for a scope

  • Custom: User-defined dimensions

Country conversations

Shows if traffic between two countries is concentrated in a small number of applications, endpoints, or protocols, or spread broadly across many. This is useful for spotting one country dominating a link, or for scoping a geo-related compliance question, without opening the Countries, Applications, and Protocols views separately and cross-referencing them.

  • Conversations by Country and Application (Application or NBAR2 Application alternative): Use this to see which applications and endpoints are driving traffic to or from a country.

    Dimensions left to right: Country A, Endpoint A, Application, Endpoint B, Country B.

  • Conversations by Country and Protocol: Use this to see which transport protocols dominate traffic to or from a country.

    Dimensions left to right: Country A, Endpoint A, Protocol, Endpoint B, Country B.

East-West conversations

Shows which application is responsible for a conversation between two internal endpoints, so you can confirm that internal traffic patterns and segmentation are behaving as expected, for example, traffic between data center segments, racks, or internal services. Available in Application and NBAR2 Application alternatives.

Dimensions left to right: Endpoint A, Application, Endpoint B.

North-South conversations

Shows which application is actually driving traffic across your network boundary, so you can identify what's saturating the perimeter or internet-bound link rather than assuming it. Available in Application and NBAR2 Application alternatives.

Dimensions left to right: Endpoint A, Application, Endpoint B.

Protocol conversations

Shows which applications are running on a given transport protocol, so you can catch protocol-application mismatches that can signal misconfiguration or something to investigate further. Available in Application and NBAR2 Application alternatives.

Dimensions left to right: Endpoint A, Protocol, Application, Endpoint B.

Unmonitored traffic

Shows the full path of traffic that doesn't match any configured Application definition, so you can decide whether to define a new application for it or investigate it further. Unclassified traffic can reveal gaps in your application definitions. For more information about defining applications, see Applications and service ports in NTA.

Dimensions left to right: Country A, Endpoint A, Protocol, Port, Application Candidate, Endpoint B, Country B.

Usage by IP Address Group

Shows which applications are driving traffic for a given site, VLAN, or tenant, so you can compare usage across the IP Address Groups you've defined. Available in Application and NBAR2 Application alternatives. For more information about configuring IP Address Groups, see IP address groups in NTA.

Dimensions left to right: Endpoint, Application, IP Address Group.

Application composition

Shows which applications are used by which endpoints. Band width represents each application's share of traffic, making it easier to compare traffic volumes across application and endpoint combinations. Available in Application and NBAR2 Application alternatives.

Dimensions left to right: Endpoint, Application.

Custom

NetFlow Flow History (Custom) lets you build your own view by selecting which dimensions to include and in what order. It is the only predefined view where dimensions can be added or removed, not just reordered. See Change the chart dimensions.