NTA System Overview

Network Traffic Analysis uses the flow caching/exporter enabled on your source device (a properly configured interface, switch, or gateway) to get flow packets.

SNMP or flow caching/export must be enabled at the potential flow export devices (network switches and interfaces, for example). Network Traffic Analysis flow collectors identify potential flow export devices on your network (also referred to herein as flow "source devices") and automatically begin gathering their flow packets. You can elect to stop and later restart Network Traffic Analysis monitoring on selected source devices using controls provided in the NTA Sources Library.

A network flow is a unidirectional sequence of packets observed traveling through a flow caching and export device (referred to throughout this guide as an NTA source), which is intended for a destination device. In other words, a single TCP connection between two hosts can only be represented by two different flows.

Flow monitor data is comprised of the following data fields:

• Source IP address and port number
• Destination IP address and port number
• IP Protocol
• Ingress interface
• IP Type of Service (ToS)

Using Network Traffic Analysis Monitoring to Complement WhatsUp Gold Monitoring

Network Traffic Analysis complements other forms of monitoring because it is less invasive and returns network data independent of the availability of both the sender or receiver device. In other words, even if a particular destination device is down or not responding to active monitors, you can use Network Traffic Analysis monitoring to generate reports and dashboards that provide check points from each network hop (upstream or downstream network devices, for example) that support flow packet export.

With Network Traffic Analysis, WhatsUp Gold can return critical availability, usage metrics, and indicators for entire segments and sections of your network. For example, Network Traffic Analysis provides visibility into network status even when a device stops responding to WhatsUp Gold active and performance monitoring. For example, Network Traffic Analysis enables you analyze root cause and designate attribution when aberrant or misconfigured devices degrade QoS, cause congestion, and disrupt service availability.

Network Traffic Analysis Data Analysis and Reporting

You can leverage Network Traffic Analysis logs, data, and dashboards in order to:

• Identify network usage needed to make hardware upgrade, network capacity, and other scaling decisions.
• Recognize and correct network configuration issues that consume network resources or expose your network to security vulnerabilities.
• Identify traffic which may indicate unauthorized use of peer-to-peer file sharing applications or a denial-of-service attack against your organization.
• Troubleshoot and correct causes of periodic spikes in network traffic before they become problems.

Tip: Network Traffic Analysis can collect and generate reports for Flow data from multiple devices.

See Also Network Traffic Analysis NTA System Requirements NTA Quick Start Choosing NTA Sources Configuring and Enabling Collection on Sources Aggregating Sources Grouping Traffic Classifying Traffic by Port Number Adding Custom Labels for Type of Service (ToS) IDs Listener Port, Collection, and Retention Settings Collector Database Maintenance Reduce and Analyze Traffic with Advanced Filtering