Congratulations on your purchase of SolarWinds Orion NetFlow Traffic Analyzer. Because you need to know both how your bandwidth is being used and who is using it, you can rely on NetFlow Traffic Analyzer to provide simple, integrated answers. Taking advantage of NetFlow technology from Cisco Systems Inc., NetFlow Traffic Analyzer enables you to quickly trace and monitor how specific applications and types of traffic are using your bandwidth. Additionally, the NetFlow and network data provided by NetFlow Traffic Analyzer are superior to the information provided by other NetFlow analysis products that generate purely extrapolated data. Network Traffic Analyzer data are based on real statistics collected from your network by the SolarWinds Orion Network Performance Monitor product that is the foundation of NetFlow Traffic Analyzer.

Upon installation, NetFlow Traffic Analyzer offers broad monitoring, charting, and reporting capabilities that are coupled with detail-driven statistics, including the following:

• Bandwidth distribution across traffic types
• Network device usage patterns over time
• External traffic identification and tracking
• Tight integration with detailed interface performance statistics

These monitoring capabilities, along with easily configurable alerting, a customizable web-based interface, and robust reporting engines, make Orion NetFlow Traffic Analyzer the easiest choice to make for monitoring your NetFlow-enabled network.

New Features in this Version

NetFlow Traffic Analyzer version 3.0 includes the following new features:

• QoS Performance Views - Easily view network traffic segmented by Class of Service methods such as Type of Service or DSCP. Quantify and visualize the amount of traffic each of your Quality of Service (QoS) levels is consuming including voice and video data.
• Personalized Traffic Views - Create and access personalized views by filtering NetFlow information for specific details such as domain traffic generated during standard office hours (8-5p) from a specific IP address excluding application data on port 514.
• Additional flow support is now available for:
• NetFlow v9
• sFlow v5
• J-Flow
• Port Application Grouping - Assign an application which uses several network ports to a group to gauge performance for an application.
• Network-wide resources are now available - Top XX Applications, Conversations, Endpoints, Types of Service, Transmitters, Receivers, Protocols, Countries, and IP Address Groups have all been added.
• Fully integrated NetFlow resources within Orion views - NetFlow resources can easily be added to Orion views automatically.
• Immediate DNS Lookup - You can now perform a quick manual DNS lookup when the scheduled DNS update feature has not updated yet.
• Search for IP address ranges - The ability to search for IP address ranges is now available using the Search IP feature.
• New Resource - Top XX NetFlow Source by % Utilization resource has been added.

Features in Previous Versions

NetFlow Traffic Analyzer version 2.2.1:

• A Top XX Types of Services resource is now available in the following views:
  • NetFlow Country view
  • NetFlow Domain view
  • NetFlow IP Address Group view
  • NetFlow Node Details view
• Admin account views may now be limited by Groups of Nodes.

NetFlow Traffic Analyzer version 2.2:

• Top XX resources can now display percentages in either absolute or relative terms. Absolute percentages are calculated for each item based on all monitored items. Relative percentages for each item are calculated in terms of the total number of items (XX) displayed in the selected resource. For more information, see Customizing Top XX Resources in the SolarWinds Orion NetFlow Traffic Analyzer Administrator Guide.
• A new Configuration Wizard makes the configuration process simpler and more efficient for you.
• NetFlow Traffic Analyzer can now limit monitoring by protocol type. Specific protocols may be designated for exclusion from NetFlow monitoring, as necessary.
• NetFlow Traffic Analyzer can now characterize traffic according to the Type of Service byte value (also known as the DiffServ Code Point) in NetFlow version 5 packets. Additionally, you can assign custom names to each Type of Service byte value.
• Top XX Types of Services is a new resource that is available for viewing in this version.
• After defining an IP Address Group, NetFlow Traffic Analyzer now allows you to search for it by name. In the Search NetFlow Endpoint resource, located by default on the NetFlow Traffic Analysis Summary page, enter the name you are searching, select IP Address Group Name in the Search by field, and then click Search. For more information about defining IP Address Groups, see Selecting IP Address Groups for Monitoring in the SolarWinds Orion NetFlow Traffic Analyzer Administrator Guide.
• Area charts, in addition to updated 2D and 3D pie charts, are now available as an option in chart-generating resources.
• Top XX resources can now report traffic in terms of either absolute or relative percentages.
• Starting with NetFlow Traffic Analyzer version 2.2, limitations enabled in Orion Network Performance Monitor may be applied to NetFlow Traffic Analyzer views. With Admin access to Orion Network Performance Monitor, you may configure account limitations from the Orion Website Administration page in the Orion Web Console. As in Orion Network Performance Monitor, account limitations may be enabled on the basis of custom properties that are defined with the Orion Account Limitation Builder. For more information about account view limitations, see Setting Account Limitations in the SolarWinds Orion Network Performance Monitor Administrator Guide.
  Note: NetFlow Traffic Analyzer initially caches account limitations, so it may take up to a minute for account limitations in NetFlow Traffic Analyzer to take effect.
• Applications may now be differentiated by protocol. NetFlow Traffic Analyzer can be configured to monitor multiple applications on the same port if they use different protocols.
• NetFlow endpoints are now searchable by IP Address Group Name.
• NetFlow Traffic Analyzer version 2.2 initiated a new Configuration Wizard that simplifies the configuration process. The new configuration wizard focuses only on those aspects of your Orion installation that deal with NetFlow data collection. Because NetFlow Traffic Analyzer is a module of Orion Network Performance Monitor, the new Configuration Wizard confirms your initial Orion settings and gives you the option to update only those website, database, and services settings that are related to your NetFlow Traffic Analyzer installation, making the configuration process both simpler and more efficient.
• NetFlow Traffic Analyzer version 2.2 introduced protocol filtering of NetFlow traffic. Specify protocols for monitoring on the Monitored Protocols page of NetFlow Settings, where NetFlow Traffic Analyzer maintains a list of possible protocols. Clearing a protocol on this page instructs NetFlow Traffic Analyzer to ignore traffic of the cleared protocol type. Likewise, NetFlow Traffic Analyzer will continue to monitor traffic of any and all protocol types that remain checked. Selectively specifying monitored protocols can reduce the amount of NetFlow traffic that NetFlow Traffic Analyzer processes and improve overall performance. For more information, see Configuring Protocol Monitoring in the SolarWinds Orion NetFlow Traffic Analyzer Administrator Guide.

Fixes in this Version

NetFlow Traffic Analyzer version 3.0 includes the following fixes:

• Resolved issue where IP Address Groups Chart would periodically show as a red "X"
• Fixed issue where the NetFlow Sources - NetFlow "Exporters Only" option does not display all available exporters.
• Removed limitation where users would not have rights to NetFlow views if the views were created prior to the latest NetFlow install.
• Fixed issue where "Exception: error occurred during packet processing. Object reference not set to an instance of an object." errors would appear in the Event Log.
• Resolved issue where the Top XX IP Address Groups resource only listed 1 group.
• Updated Charting component to resolve issue related to dips in data.
• Resolved issue where Orion NetFlow Traffic Analyzer ignored the “Keep compressed data for x days” setting and retained all compressed data resulting in a larger than desired database size.
  Note: Now that this issue has been fixed, data older than 90 days will be removed from the database after upgrading.
• Fixed issue where in certain specific situations, the times below the graphs would repeat.
• Restarting the NetFlow service to view NetFlow data on recently added NetFlow interfaces is no longer required.

Fixes in Previous Versions

NetFlow Traffic Analyzer version 2.2.1:

• The SQL Open Error encountered when an account with defined limitations attempted to edit the NetFlow Sources resource has been fixed.
• Resources reporting Total Traffic over similar historical time periods that include both compressed and uncompressed data now display correctly.
• A page refresh is no longer required when adding or editing a port on the Edit Application and Service Ports view.
• The Top XX Types of Services resource is now available in NetFlow Domain, NetFlow IP Address Group, NetFlow Country, or NetFlow Node Details views.
• Search results are now counted and presented correctly in the Edit Application and Service Ports view.
• An error that was occurring when nodes not currently receiving traffic are selected and expanded has been fixed.
• Area charts in IP Address Groups and Unique Visitors resources now display correctly.
• Resources now display hostnames instead of less-descriptive IP addresses for manually added endpoints.
• The Domain Details resource of the NetFlow Domain view now reports values for Total Traffic on the selected domain consistent with the same value reported in the Top XX Domains resource.
• Resources in the NetFlow Endpoint view now correctly report Total Traffic measurements.
• The chart of Total Bytes Transferred now responds promptly after starting NetFlow data collection.
• Top XX IP Address Groups resource area charts now display correctly in the NetFlow Node Details view.
• Labels on the horizontal axis of charts in the Total Bytes Transferred resource over periods greater than the Last Hour now display legibly.
• NetFlow Traffic Analyzer now properly recognizes English UK regional date/time settings.
• Group of Nodes limitations can now be applied to Admin accounts.
• An issue that caused a Website Error when previewing a detached Node Interfaces resource while managing the NetFlow Application view has been resolved.
• Area charts now display correctly in the Total Bytes Transferred resource in the NetFlow Conversation view.
• The Last XX Events resource now properly handles NULL entries.
• An issue where some instances of the Traffic History resource were not working in NetFlow Traffic Analyzer upgrades has been fixed.
• Time periods for resources in the NetFlow Interface Details View are now consistent whether the resources are embedded or detached.
• Top XX resources now show correct endpoints when the resources are detached.
• Resource area charts are now able to display small amounts of data collected over small time periods.
• Unique Visitors resources now display area charts correctly.
• NetFlow Service settings were adjusted to avoid errors when NetFlow Traffic Analyzer is running on 64-bit operating systems.
• The NetFlow Sources resource now lists monitored NetFlow sources in alphabetical order by hostname.
• Port searches on strings now operate correctly in the Application and Service Ports view.
• NetFlow Traffic Analyzer version 2.2.1 has restored clickable interface names. In this version, you can drill down through nodes to interfaces and click an interface name to open the Interface Details view.
• An issue with the timely resolution and expiration of DNS names has been fixed.
• In certain specific situations, previewing a managed view generated errors in previous versions. This version includes on-screen instructions for dealing with the error condition if it arises.
• In certain specific situations, clicking an endpoint link in a Top XX Endpoints, Top XX Receivers, or Top XX Transmitters resource generated errors in previous versions. This error condition has been fixed.

NetFlow Traffic Analyzer version 2.2:

• NetFlow Endpoints are now searchable by IP Address Group Name.
• Both IP Address Group names and ranges may now be edited.
• Additional NetFlow Traffic Analyzer receivers and installations of NetFlow Traffic Analyzer on additional Orion NPM web servers now have separate install procedures.
• NetFlow Collectors may now be deleted as necessary.
• The Top XX Applications resource now accurately reports total traffic traversing an interface by including unmonitored traffic.
• Interfaces may now be collapsed under their respective nodes in the NetFlow Sources resource.
• The NetFlow Sources resource is now more reliable and more scalable.
• Reported traffic levels for the last hour are now consistent with reported traffic levels for periods less than an hour.
• Calculations of endpoint traffic in Top XX resources have been corrected.
• NetFlow Domain reports now work correctly.
• The Configuration Wizard now starts automatically after installation. This fixes a problem in version 2.1 regarding the inability of the web console to display NetFlow data prior to running the Configuration Wizard.
• An issue resulting in timeouts on the NetFlow Traffic Analysis Summary view when large numbers of NetFlow sources are monitored has been fixed.

Additional Pollers and Web Servers

If you have installed any additional NetFlow receivers or installed NetFlow Traffic Analyzer on any additional web servers, you should upgrade these receivers and servers to this version of NetFlow Traffic Analyzer.

Installing this Version

You do not need to uninstall your previous version to install this version of Orion NetFlow Traffic Analyzer. Shut down any Orion Network Performance Monitor or NetFlow Traffic Analyzer applications that you may have running, and then run the installation executable, followed by the Configuration Wizard. For more information about installing NetFlow Traffic Analyzer, see Installing Orion NetFlow Traffic Analyzer in the SolarWinds Orion NetFlow Traffic Analyzer Administrator Guide.

Warnings:

• You must first install version 8.5.1 or higher of Orion Network Performance Monitor if you want to install this version of NetFlow Traffic Analyzer.
• Orion Network Performance Monitor, including the NetFlow Traffic Analyzer module, does not support the use of case-sensitive database servers.
• Whenever you install a new module or upgrade Orion Network Performance Monitor, ensure you first back up your database.

Notes:

• NetFlow Traffic Analyzer version 3.0 requires Orion Network Performance Monitor version 8.5.1 or higher.
• If you are installing NetFlow Traffic Analyzer on a terminal server, use the Add or Remove Programs utility on you server (Start > Control Panel > Add or Remove Programs) to run the NetFlow Traffic Analyzer installer. For more information, see Installing Orion NetFlow Traffic Analyzer in the SolarWinds Orion NetFlow Traffic Analyzer Administrator Guide.
• SQL Express and MSDE are not supported for use with NetFlow Traffic Analyzer.
• Windows 2000 Server is no longer supported for NetFlow Traffic Analyzer installations.

Licensing NetFlow Traffic Analyzer

Licensing for NetFlow Traffic Analyzer follows the licensing levels of your underlying Orion Network Performance Monitor installation. For more information about Orion licensing, see Licensing Orion Network Performance Monitor in the SolarWinds Orion Network Performance Monitor Administrator Guide.

The following types of NetFlow licenses are currently available.

• Orion NetFlow Traffic Analyzer for Orion SL100
• Orion NetFlow Traffic Analyzer for Orion SL250
• Orion NetFlow Traffic Analyzer for Orion SL500
• Orion NetFlow Traffic Analyzer for Orion SL2000
• Orion NetFlow Traffic Analyzer for Orion SLX

Upgrading NetFlow Traffic Analyzer

You cannot upgrade directly from NetFlow Traffic Analyzer 1.x to the current version. You can either uninstall your current version and then install version 3.0 using a new database, or you can contact Technical Support for aid in moving to 2.x and then to version 3. For more information, contact support at support.solarwinds.com.

Upgrading your NetFlow installation to version 3.0 may take several hours to complete depending on the size of your database. The upgrade process seems to stop responding when displaying Processing NetFlowDatabaseScheme.dbConfig file. However, the upgrade is still working in the background. It is recommended that you perform the upgrade during a maintenance time period to avoid any interruptions during normal operating hours.

Note: The SQL Server transaction log may grow significantly when running the Configuration Wizard for the first time after the upgrade. If you have SQL Server limitations on the transaction log file size, you may run into a hard limit that could potentially cause a failure.

Configuring NetFlow Data Export

If your NetFlow device does not use the ip route-cache flow command in its configuration file, it may use the MLS NDE SENDER command. An explanation of the process of enabling Cisco Catalyst switches for NetFlow data export is currently available in Enabling NetFlow and NetFlow Data Export on Cisco Catalyst Switches on the SolarWinds website. For more information about configuring your NetFlow device, consult the documentation provided by your device manufacturer. For more information about MLS NDE SENDER on Catalyst 4500 and 6500 switches and Cisco 7600 series routers, see Catalyst 4500, Catalyst 6500, and Cisco 7600 on the Cisco website.

Configuring sFlow Devices

When configuring your sFlow device, you need to set the flow data to be sent on port 2055. For more information about configuring sFlow devices for Orion NetFlow Traffic Analyzer, see Device Configuration Examples in the SolarWinds Orion NetFlow Traffic Analyzer Administrator Guide

Improved Searching for NetFlow Sources

The NetFlow endpoint search utility was improved in NetFlow Traffic Analyzer version 2.1 for faster response times. Beginning with version 2.1, more information about individual NetFlow-enabled endpoints is stored in the Orion Network Performance Monitor database to facilitate database searches.

Note: Initially, NetFlow Traffic Analyzer stores extra information for NetFlow data sources that are added after an upgrade to version 2.2 or later. The following procedure configures NetFlow Traffic Analyzer to search for NetFlow sources that were monitored by pre-2.1 versions of NetFlow Traffic Analyzer.

To include pre-existing NetFlow sources in NetFlow Traffic Analyzer searches:

1. Install NetFlow Traffic Analyzer version 3.0 and complete the Configuration Wizard. For more information about installing NetFlow Traffic Analyzer, see Installing Orion NetFlow Traffic Analyzer in the SolarWinds Orion NetFlow Traffic Analyzer Administrator Guide.
2. Click Start > SolarWinds Orion > Database Utilities > Database Manager.
3. Select and expand the server that is hosting your Orion Network Performance Monitor database in the server tree in the left pane of the Database Manager window.
4. Select and expand your Orion Network Performance Monitor database in the server tree in the left pane of the Database Manager window.
5. Select the NetFlowSearchByAddress table.
6. Click Table > Query Table.
7. Select Read-Write (Results can be edited).
8. Add the following commands to the existing query:

select distinct SourceIPSort, InterfaceIDRx from NetFlowSummary
union all
select distinct DestIPSort, InterfaceIDTx from NetFlowSummary

9. Click Refresh.
10. Select the NetFlowSearchByPort table in the server tree in the left pane of the Database Manager window.
11. Click Table > Query Table.
12. Select Read-Write (Results can be edited).
13. Add the following commands to the existing query:

select distinct SourcePort, InterfaceIDRx from NetFlowSummary where SourcePort > 0
union all
select distinct DestPort, InterfaceIDTx from NetFlowSummary where DestPort > 0

14. Click Refresh.

Selecting Views by Device Type

If you want to edit node views or assign views by type of node and you use the Views by Device Type option, ensure that you select Node Details for each of the node views that you do not want to change. With NetFlow Traffic Analyzer installed, the new default web view becomes NetFlow Node Details, which may not be the view that you want.

Unresolved IP Addresses

IP addresses that are unresolved at the time that NetFlow Traffic Analyzer is installed will remain unresolved, even after DNS can resolve them. To avoid timeout waits, Orion NetFlow Traffic Analyzer does not attempt to resolve IP addresses to DNS names again until 2 days after the initial failure.
Note: You can now click Lookup to perform a DNS lookup in realtime.

Unexpected Chart Data

In NetFlow Traffic Analyzer version 2.2.1, summary charts were displayed by default with a range of 15 minutes. In NTA 3.0, the range now defaults to 2 hours. Data points on the graphs are indicated for each increment in the x-axis of the graph. For a 15 minute range, data points are shown every 1 minute. On the 2 hour graph, data is shown every 15 minutes. The points on the charts then are for the amount of traffic during that increment. Since the default chart is now 2 hours, you will see on this page by default 15 times the traffic value on the y-axis for every data point.

Uninstalling NetFlow Traffic Analyzer

If you uninstall NetFlow Traffic Analyzer, you will need to complete the following procedure to ensure that your installation of Orion Network Performance Monitor is not negatively affected.

To safely uninstall NetFlow Traffic Analyzer version 3.0:

1. Click Start > Control Panel > Add or Remove Programs.
2. Select SolarWinds Orion NetFlow Traffic Analyzer, and then click Change/Remove.
3. Select Remove, click Next, and then follow the prompts to complete the uninstallation of NetFlow Traffic Analyzer by clicking Finish.
4. Click Start > Control Panel > Add or Remove Programs.
5. Select SolarWinds Orion Network Performance Monitor, and then click Change/Remove.
6. Select Repair, click Next, and then follow the prompts to complete the repair of Orion Network Performance Monitor by clicking Finish.

After uninstalling, you may encounter a "Could not load file or assembly" error when accessing your Node Details or Interface Details view. To resolve this error, complete the following procedure.

To resolve the error message:

1. Log into the web console using an account with admin privileges.
2. Click Admin.
3. Click Manage Views.
4. Select the Node Details or Interface Details view that is causeing the error, and then click Edit.
5. Remove any NetFlow resources you see listed.
6. Click Done.

Other Known Issues

The following issues may arise in your installation of Orion NetFlow Traffic Analyzer Version 3.0. These are known issues that are being addressed for a future release.

• The Network Wide Top XX Countries resource may generate a “Failed to enable constraints” error.
• Resources do not display Chinese characters correctly.
• Resources with charts that display more than four items will not show a full legend. Area charts display items in ranked order, from bottom to top. Pie charts are labeled with percentage values.
• Toolset integration is not currently enabled.

Legal

Copyright© 1995-2008 SolarWinds, Inc. All Rights Reserved Worldwide. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the express, written consent of SolarWinds. All right, title and interest in and to the software and documentation are and shall remain the exclusive property of SolarWinds and its licensors. SolarWinds Orion™, SolarWinds Cirrus™, and SolarWinds Toolset™ are trademarks of SolarWinds and SolarWinds.com® and the SolarWinds logo are registered trademarks of SolarWinds. All other trademarks contained in this document and in the Software are the property of their respective owners.

SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS OR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Microsoft® and Windows 2000® are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

Graph Layout Toolkit and Graph Editor Toolkit © 1992 - 2001 Tom Sawyer Software, Oakland, California. All Rights Reserved.

Portions Copyright © ComponentOne, LLC 1991-2002. All Rights Reserved.