The Release Notes, as well as the SolarWinds products, take advantage of JavaScript. Please enable active scripting.

Congratulations on your purchase of SolarWinds Orion NetFlow Traffic Analyzer (Orion NTA). Because you need to know both how your bandwidth is being used and who is using it, you can rely on Orion NTA to provide simple, integrated answers. Supporting NetFlow, sFlow, J-Flow, and IPFIX technologies, Orion NTA enables you to quickly trace and monitor how specific applications and types of traffic are using your network bandwidth. Orion NTA data are based on real statistics collected from your network by the proven SolarWinds Orion Network Performance Monitor. As a result, the network data and insight provided by Orion NTA are superior to the information provided by other Flow data analysis products that generate purely extrapolated data.

Upon installation, Orion NTA offers broad monitoring, charting, and reporting capabilities that are coupled with detail-driven statistics, including the following:

  • Bandwidth distribution across traffic types
  • Network device usage patterns over time
  • External traffic identification and tracking
  • Tight integration with detailed interface performance statistics
  • Class-Based Quality of Service reporting

These monitoring capabilities, along with easily configurable alerting, a customizable web-based interface, and robust reporting engines, make Orion NTA the easiest choice to make for monitoring your Flow-enabled network.

Notes Note: If you have applied Service Packs or Hotfixes to your product, they were delivered with readme.txt files. These files contain fixes that supercede the information found in the Release Notes.

Orion NTA Features

The following sections provide an overview of features that are available in this version of Orion NTA, including features introduced in previous versions.

New Features in this Version

Orion NetFlow Traffic Analyzer version 3.5 includes the following new features:

  • Class-based Quality of Service Resources - New resources for monitoring and reporting class-based quality of service (CBQoS) policies and metrics enable you to quickly see how your enabled CBQoS policies are handling traffic on your network.
  • Optional Ingress- and Egress-specific Monitoring - Monitor and display statistics for all traffic either entering any interface (ingress), exiting any interface (egress), or both entering and exiting any interface.
  • IP Flow Information Export Support - Orion NTA now supports monitoring devices using the developing IP Flow Information Export (IPFIX) standard for traffic analysis.
  • Unmonitored Ports Information - This version of Orion NTA provides additional data about unmonitored ports and applications.
  • Enhanced Web Console Performance - Additional options related to DNS resolution in Orion NTA resources can improve overall web console performance.
  • Flow Collection on Multiple Ports - Orion NTA now supports the collection of Flow records on multiple ports.

Features in Previous Versions

Previous versions of Orion NTA included the following features:

Orion NetFlow Traffic Analyzer version 3.1:

  • Flow Sources May be Added Automatically - This version of Orion NTA provides the option to automatically add Flow source devices if they are already monitored by Orion NPM.
  • Accelerated Resource, View, Chart, and Graph Creation - By default, resources in previous versions of Orion NTA displayed data for the last 2 hours, and this default was not configurable. Now you can set the default resource data period to help accelerate resource and view loading as shorter data periods will result in faster chart and graph creation.
  • Scheduled Database Maintenance - Orion NTA allows you to minimize unnecessary memory usage by scheduling the time, frequency, and type of database maintenance for optimal performance.
  • Database Size Management - It is possible that Flow-enabled network devices may send data for traffic on ports that are not actually monitored by Orion NTA. With this version, you can free up valuable space in your database for the Flow data you really need by choosing to ignore traffic data from unmonitored ports.

Orion NetFlow Traffic Analyzer version 3.0:

  • QoS Performance Views - Easily view network traffic segmented by Class of Service methods such as Type of Service or DSCP. Quantify and visualize the amount of traffic each of your Quality of Service (QoS) levels is consuming including voice and video data.
  • Personalized Traffic Views - Create and access personalized views by filtering NetFlow information for specific details such as domain traffic generated during standard office hours (8-5p) from a specific IP address excluding application data on port 514.
  • Additional flow support is now available for:
    • NetFlow v9
    • sFlow v5
    • J-Flow
  • Port Application Grouping - Assign an application which uses several network ports to a group to gauge performance for an application.
  • Network-wide resources are now available - Top XX Applications, Conversations, Endpoints, Types of Service, Transmitters, Receivers, Protocols, Countries, and IP Address Groups have all been added.
  • Fully integrated NetFlow resources within Orion views - NetFlow resources can easily be added to Orion views automatically.
  • Immediate DNS Lookup - You can now perform a quick manual DNS lookup when the scheduled DNS update feature has not updated yet.
  • Search for IP address ranges - The ability to search for IP address ranges is now available using the Search IP feature.
  • New Resource - Top XX NetFlow Source by % Utilization resource has been added.

Orion NTA Fixes

The following sections provide information related to fixes in this and previous versions of Orion NTA.

Fixes in this Version

Orion NetFlow Traffic Analyzer version 3.5 includes the following fixes:

  • Chart resources now provide color icons next to each listed element to aid in mapping table data to corresponding charts.
  • Orion NTA reports sent as email messages using the Orion Report Scheduler now display correctly.
  • NetFlow version 5 packets provided by ImageStream Rebel Routers are currently received and analyzed as designed.
  • Requests to edit a device hostname using the Edit button in Endpoint Details resources no longer cause Orion Website Errors or timeouts.
  • Installations of Orion NTA on additional web servers now generate reports correctly.
  • Orion NTA resources are now automatically hidden on Orion Node Details views for nodes that are not Flow recognized sources.
  • A database migration failure issue has been corrected.
  • An error condition forcing the SolarWinds NetFlow Service to stop shortly after startup has been corrected.
  • DNS resolution in Orion NTA has been reconfigured to correct an issue that caused the SolarWinds NetFlow Service to stop with an out of memory error.

Fixes in Previous Versions

Previous versions of Orion NetFlow Traffic Analyzer have included the following fixes:

Orion NetFlow Traffic Analyzer version 3.1

  • An issue where the web console and reports do not display data for longer time periods consisting of smaller intervals has been fixed.
  • When selecting the default network device for NetFlow Node Details and NetFlow Interface Details views, lists of valid nodes and interfaces, respectively, are now provided.
  • Orion NTA has been confirmed compatible with case-sensitive SQL Server databases.
  • Performance of the Manage Application and Service Ports view has been improved for large lists of ports and applications.
  • A performance issue due to excessive updates of the NetFlow Sources table has been fixed.
  • The Configuration Wizard no longer overwrites user-defined IP address groups if any of the IP addresses in the user-defined groups are contained within the default IP address group (10.0.0.0 – 10.255.255.255) defined for Orion.
  • Network taffic data is now properly displayed for added interfaces that were previously deleted from mnoitoring.
  • Choosing to monitor all ports now enables all disabled applications on formerly unmonitored ports.
  • Flow source IP addresses no longer overwrite source hostnames in the event of a failed DNS lookup.
  • Domain names now correctly resolve from hostnames provided with only one period, as in solarwinds.com.
  • An issue where Orion NTA performance counters were either missing or not properly created has been fixed.
  • Icons for Riverbed devices are now displayed correctly.
  • NetFlow v9 templates are now stored with the source ID field, in addition to the previously stored source IP address and template ID, to differentiate multiple Flow streams originating in the same exporter.
  • Top XX resources now properly respect the No Chart option for Resource Style on the Edit Top XX Resource view.
  • The NetFlow Sources resource no longer lists source duplicates in the event that the status of any interface on the source has been changed to Unmonitored.
  • An issue that caused some charts to display incorrect negative data values has been corrected.
  • Changing the location of the Traffic View Builder resource on the NetFlow Traffic Analysis Summary view no longer generates an error.
  • Loading of the Top XX Domains resource has been accelerated.
  • The library used by Orion NTA to perform DNS lookups has been changed to fix errors encountered with DNS resolution.
  • The Edit NetFlow Sources view has been fixed to no longer display the footer divider and text in the middle of the source list.
  • In the case that some browsers are configured incorrectly, a large "Access Denied" image has been replaced with an error message providing information to correct the browser configuration issue.
  • Views containing interface in/out percent utilization resources are no longer prevented from loaded properly when monitored interfaces provide nonstandard or invalid values for percent utilization.
  • The current version of Orion NTA properly handles sFlow packets that are neither bridged, routed, nor otherwise transmitted through any monitored interface.

Orion NetFlow Traffic Analyzer version 3.0:

  • Resolved issue where IP Address Groups Chart would periodically show as a red "X"
  • Fixed issue where the NetFlow Sources - NetFlow "Exporters Only" option does not display all available exporters.
  • Removed limitation where users would not have rights to NetFlow views if the views were created prior to the latest NetFlow install.
  • Fixed issue where "Exception: error occurred during packet processing. Object reference not set to an instance of an object." errors would appear in the Event Log.
  • Resolved issue where the Top XX IP Address Groups resource only listed 1 group.
  • Updated Charting component to resolve issue related to dips in data.
  • Resolved an issue where Orion NetFlow Traffic Analyzer ignored the “Keep compressed data for x days” setting and retained all compressed data resulting in a larger than desired database size.
    Note: Now that this issue has been fixed, data older than 90 days will be removed from the database after upgrading.
  • Fixed issue where in certain specific situations, the times below the graphs would repeat.
  • Restarting the NetFlow service to view NetFlow data on recently added NetFlow interfaces is no longer required.

Installing and Upgrading Orion NTA

The following sections provide required information to consider before installing or upgrading Orion NTA.

Additional Pollers and Web Servers

If you have installed any additional NetFlow receivers or installed Orion NetFlow Traffic Analyzer on any additional web servers, you should upgrade these receivers and servers to this version of Orion NetFlow Traffic Analyzer.

Licensing Orion NTA

Licensing for Orion NetFlow Traffic Analyzer follows the licensing levels of your underlying Orion Network Performance Monitor installation. For more information about Orion licensing, see Licensing Orion Network Performance Monitor in the SolarWinds Orion Network Performance Monitor Administrator Guide.

The following types of NetFlow licenses are currently available.

  • Orion NetFlow Traffic Analyzer for Orion SL100
  • Orion NetFlow Traffic Analyzer for Orion SL250
  • Orion NetFlow Traffic Analyzer for Orion SL500
  • Orion NetFlow Traffic Analyzer for Orion SL2000
  • Orion NetFlow Traffic Analyzer for Orion SLX

Installing this Version

You do not need to uninstall your previous version to install this version of Orion NetFlow Traffic Analyzer. Shut down any other SolarWinds Orion applications, including any of the following:

  • Orion NetFlow Traffic Analyzer
  • Orion Network Performance Monitor
  • Orion Application Performance Monitor
  • Orion Network Configuration Manager

After shutting down all SolarWinds Orion applications, run the installation executable, and then run the Configuration Wizard.

For more information about installing Orion NetFlow Traffic Analyzer, see Installing Orion NetFlow Traffic Analyzer in the SolarWinds Orion NetFlow Traffic Analyzer Administrator Guide.

Warnings:

  • Before installing or upgrading any module, including Orion Network Performance Monitor, ensure you first back up your database.
  • You must first install Orion Network Performance Monitor version 9.5 or higher if you want to install this version of Orion NetFlow Traffic Analyzer.

Notes:

  • If you are installing Orion NetFlow Traffic Analyzer on a terminal server, use the Add or Remove Programs utility on you server (Start > Control Panel > Add or Remove Programs) to run the Orion NetFlow Traffic Analyzer installer. For more information, see Installing Orion NetFlow Traffic Analyzer in the SolarWinds Orion NetFlow Traffic Analyzer Administrator Guide.
  • SQL Express and MSDE are not supported for use with Orion NetFlow Traffic Analyzer.
  • Windows 2000 Server is no longer supported for Orion NetFlow Traffic Analyzer installations.

Installing Service Packs

Occasionally, SolarWinds may provide service packs to address issues that arise after the release of this version of Orion NetFlow Traffic Analyzer. Due to the nature of the database migration that this version of Orion NetFlow Traffic Analyzer completes, service packs should not be installed while Orion NetFlow Traffic Analyzer is migrating your Orion database. Either of the following options addresses this potential conflict:

  • Ensure that both the latest service pack executable and your Orion NetFlow Traffic Analyzer installation executable are in the same folder when you launch the Orion NetFlow Traffic Analyzer installation executable.
  • Do not apply the service pack until after Orion NetFlow Traffic Analyzer has completed your Orion database migration and you have run the Configuration Wizard.

Upgrading Orion NTA

If you are currently using any version of Orion NTA prior to version 3.1, you cannot upgrade directly to the current version. You must first be running an installation of Orion NTA version 3.1 before you can upgrade to this version.

To complete an upgrade from any version prior to version 3.1, you can either uninstall your current version and then install version 3.5 using a new database, or you can contact Technical Support for assistance in progressing through required installations to version 3.1 before upgrading to version 3.5. For more information, contact support at support.solarwinds.com.

Upgrading your NetFlow installation to version 3.5 from versions prior to version 3.1 may take several hours to complete, depending on the size of your database. The upgrade process may appear to stop responding when displaying Processing NetFlowDatabaseScheme.dbConfig file. However, the upgrade is still working in the background. It is recommended that you perform the upgrade during a maintenance time period to avoid any interruptions during normal operating hours.

Note: The SQL Server transaction log may grow significantly when running the Configuration Wizard for the first time after the upgrade. If you have SQL Server limitations on the transaction log file size, you may run into a hard limit that could potentially cause a failure.

Configuring NetFlow Data Export

If your NetFlow device does not use the ip route-cache flow command in its configuration file, it may use the MLS NDE SENDER command. An explanation of the process of enabling Cisco Catalyst switches for NetFlow data export is currently available in Enabling NetFlow and NetFlow Data Export on Cisco Catalyst Switches on the SolarWinds website. For more information about configuring your NetFlow device, consult the documentation provided by your device manufacturer. For more information about MLS NDE SENDER on Catalyst 4500 and 6500 switches and Cisco 7600 series routers, see Catalyst 4500, Catalyst 6500, and Cisco 7600 on the Cisco website.

CBQoS and the Orion Database

In some cases, installations of Orion NTA version 3.5 may cause accelerated growth in the size of your Orion database, particularly the NPM_NODE_VALUES_SHADOW table, due to the method Orion NTA version 3.5 uses to resolve hostnames for CBQoS-enabled monitored devices. As shown in the following procedure, installing Orion NTA version 3.5 Service Pack 1 applies improvements to the CBQoS-related features of Orion NTA 3.5, and enabling On Demand DNS resolution decreases the amount of space required in the Orion database for DNS information.

To resolve this issue:

  1. Download and install Orion NTA version 3.5 Service Pack 1 from the SolarWinds Customer Portal.
    Note: For more information about installing service packs, see Installing Service Packs or contact SolarWinds Customer Support.
  2. Enable On Demand DNS Resolution, as shown in the following steps:
    a. Log on to the server hosting your Orion NTA installation.
    b. Click Start > All Programs > SolarWinds Orion > NetFlow Traffic Analyzer > NetFlow Web Console.
    c. Log in using an account with administrative privileges.
    d. Click Admin in the Views toolbar.
    e. Click NTA Settings in the Settings grouping.
    f. Under Global Settings, click Edit.
    g. Next to DNS Resolution, select On Demand.
    h. Click OK to enable On Demand DNS Resolution.
    i. Click Submit.

NetFlow Reports and Compressed Data

If you configure an Orion NTA report to have a time period that is shorter than the period for which you have set Orion NTA to keep uncompressed data, your configured Orion NTA report will not present any data. For more information about data compression settings in Orion NTA, see Configuring NetFlow Data Compression in the SolarWinds Orion NetFlow Traffic Analyzer Administrator Guide

Improved Searching for NetFlow Sources

The NetFlow endpoint search utility was improved in Orion NetFlow Traffic Analyzer version 2.1 for faster response times. Beginning with version 2.1, more information about individual NetFlow-enabled endpoints is stored in the Orion Network Performance Monitor database to facilitate database searches.

Note: Initially, Orion NetFlow Traffic Analyzer stores extra information for NetFlow data sources that are added after an upgrade to version 2.2 or later. The following procedure configures Orion NetFlow Traffic Analyzer to search for NetFlow sources that were monitored by pre-2.1 versions of Orion NetFlow Traffic Analyzer.

To include pre-existing NetFlow sources in Orion NetFlow Traffic Analyzer searches:

  1. Install Orion NetFlow Traffic Analyzer version 3.5 and complete the Configuration Wizard. For more information about installing Orion NetFlow Traffic Analyzer, see Installing Orion NetFlow Traffic Analyzer in the SolarWinds Orion NetFlow Traffic Analyzer Administrator Guide.
  2. Click Start > SolarWinds Orion > Database Utilities > Database Manager.
  3. Select and expand the server that is hosting your Orion Network Performance Monitor database in the server tree in the left pane of the Database Manager window.
  4. Select and expand your Orion Network Performance Monitor database in the server tree in the left pane of the Database Manager window.
  5. Select the NetFlowSearchByAddress table.
  6. Click Table > Query Table.
  7. Select Read-Write (Results can be edited).
  8. Add the following commands to the existing query:

    9. select distinct SourceIPSort, InterfaceIDRx from NetFlowSummary
    union all
    select distinct DestIPSort, InterfaceIDTx from NetFlowSummary

  9. Click Refresh.
  10. Select the NetFlowSearchByPort table in the server tree in the left pane of the Database Manager window.
  11. Click Table > Query Table.
  12. Select Read-Write (Results can be edited).
  13. Add the following commands to the existing query:

    14. select distinct SourcePort, InterfaceIDRx from NetFlowSummary where SourcePort > 0
    union all
    select distinct DestPort, InterfaceIDTx from NetFlowSummary where DestPort > 0

  14. Click Refresh.

Selecting Views by Device Type

If you want to edit node views or assign views by type of node and you use the Views by Device Type option, ensure that you select Node Details for each of the node views that you do not want to change. With Orion NetFlow Traffic Analyzer installed, the new default web view becomes NetFlow Node Details, which may not be the view that you want.

Unresolved IP Addresses

IP addresses that are unresolved at the time that Orion NetFlow Traffic Analyzer is installed will remain unresolved, even after DNS can resolve them. To avoid timeout waits, Orion NetFlow Traffic Analyzer does not attempt to resolve IP addresses to DNS names again until 2 days after the initial failure.
Notes:

  • To perform a DNS lookup in realtime, click Lookup in the Endpoint Details resource.
  • To configure this DNS resolution interval, using an account with administrative privileges, click Admin > NTA Settings, and then click Edit under the Global Settings heading. Edit the Default number of days to wait until next DNS lookup for unresolved IP addresses setting, as appropriate.

Uninstalling Orion NTA

If you uninstall Orion NetFlow Traffic Analyzer, you will need to complete the following procedure to ensure that your installation of Orion Network Performance Monitor is not negatively affected.

To safely uninstall Orion NetFlow Traffic Analyzer version 3.5:

  1. Click Start > Control Panel > Add or Remove Programs.
  2. Select SolarWinds Orion NetFlow Traffic Analyzer, and then click Change/Remove.
  3. Select Remove, click Next, and then follow the prompts to complete the uninstallation of Orion NetFlow Traffic Analyzer by clicking Finish.
  4. Click Start > Control Panel > Add or Remove Programs.
  5. Select SolarWinds Orion Network Performance Monitor, and then click Change/Remove.
  6. Select Repair, click Next, and then follow the prompts to complete the repair of Orion Network Performance Monitor by clicking Finish.

After uninstalling, you may encounter a "Could not load file or assembly" error when accessing your Node Details or Interface Details view. To resolve this error, complete the following procedure.

To resolve the error message:

  1. Log into the web console using an account with admin privileges.
  2. Click Admin.
  3. Click Manage Views.
  4. Select the Node Details or Interface Details view that is causing the error, and then click Edit.
  5. Remove any NetFlow resources you see listed.
  6. Click Done.

Other Known Issues

The following issues may arise in your installation of Orion NetFlow Traffic Analyzer Version 3.5. These are known issues that may be addressed in a future release.

  • In some views, an account-limited user may be able to see the names of network objects they are not otherwise permitted to see. Information beyond object names is not provided, in accordance with applied account limitation definitions.
  • Some application charts printed from NetFlow <Device> Details views may not resize correctly for portrait orientation. In landscape orientation, some chart objects may overlap.
  • The Network Wide Top XX Countries resource may generate a “Failed to enable constraints” error.
  • Resources do not display Chinese characters correctly.
  • To function as designed, the thwack Recent NetFlow Posts resource requires access to the internet. If your Orion server is not connected to the internet, the NetFlow Traffic Analysis Summary view may timeout. To correct this issue, remove the thwack Recent NetFlow Posts resource from all Orion Web Console views. For more information, see Customizing Views in the SolarWinds Orion Network Performance Monitor Administrator Guide.
  • Some Orion NTA resources may not display correctly if the regional settings for the IIS server hosting your Orion Web Console do not match the language preference configured in the browser used to view the web console.
  • Due to limitations in the Flow packets they provide, VMware Virtual Switches are not currently supported for monitoring with Orion NTA.
  • AOL Instant Messenger (IM) and iChat applications may be configured to use ports 16384-16403. Some real-time protocol (RTP) applications may also use ports within this designated range. If you are using Orion NTA to monitor AOL IM, iChat, or RTP traffic, you may want to confirm that there are no port assignment collisions on your network.

Legal

Copyright© 1995-2009 SolarWinds, Inc. All Rights Reserved Worldwide. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the express, written consent of SolarWinds. All right, title and interest in and to the software and documentation are and shall remain the exclusive property of SolarWinds and its licensors. SolarWinds Orion™, SolarWinds Cirrus™, and SolarWinds Toolset™ are trademarks of SolarWinds and SolarWinds.com® and the SolarWinds logo are registered trademarks of SolarWinds. All other trademarks contained in this document and in the Software are the property of their respective owners.

SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS OR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Microsoft® and Windows 2000® are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

sFlow® is a registered trademark of InMon Corporation.

Graph Layout Toolkit and Graph Editor Toolkit © 1992 - 2001 Tom Sawyer Software, Oakland, California. All Rights Reserved.

Portions Copyright © ComponentOne, LLC 1991-2002. All Rights Reserved.