NTA System Requirements

Network Traffic Analysis requires either of the following enabled on source devices:

• Flow Export. Such as NetFlow, NetFlow-Lite, sFlow, J-flow, and IPFIX.
• SNMP. Returns traffic totals when flow source export is not enabled or for sampled flow (sFlow, for example).

Network Traffic Analysis System Architecture

Note: The flow exporter can be either an included function of the network device, such as the NetFlow export functionality on Cisco routers, or an external probe configured to monitor one or more interfaces on the device, such as the Ipswitch NetFlow Probe.

Network Traffic Analysis provides flow collection and analysis. It provides a centralized location for the collection, processing, analysis, and storage of network traffic data. As network traffic data is observed at observation points, it is captured as flow data, and it is delivered by network monitoring protocols configured on flow export source devices. When a router or other device sends flow data to Network Traffic Analysis, it follows the sequence demonstrated in the illustration.

1	Flow Source (Exporter)	The flow source device (shown in the illustration as a router) observes pass-through traffic and summarizes data characteristics into a NetFlow, NetFlow-Lite, sFlow, J-Flow (sampled NetFlow) or an IP Flow Information Export (IPFIX) export datagram.
2	Flow Data	Flow packets are sent in the form of an export datagram sent to a Network Traffic Analysis collector running on the WhatsUp Gold system.
3	Collector	The Network Traffic Analysis collector stores the NetFlow, NetFlow-Lite, sFlow, J-Flow (sampled NetFlow) or IP Flow Information Export (IPFIX) export in the Network Traffic Analysis database.
4	Database	NTA and flow data are archived in a database running on the WhatsUp Gold system.
5	Web UI	WhatsUp Gold enables you to view, share, apply user-based access controls, and analyze interactive dashboards and reports for network operations, forensic analysis, capacity planning, and much more.

Note: sFlow data is sent every x number of packets (configurable on the sFlow device), whereas all NetFlow data is collected and monitored. This means that sFlow data provides a sampling of network traffic data characteristics, whereas NetFlow data provides all network traffic data.

See Also Network Traffic Analysis NTA System Overview NTA Quick Start Choosing NTA Sources Configuring and Enabling Collection on Sources Aggregating Sources Grouping Traffic Classifying Traffic by Port Number Adding Custom Labels for Type of Service (ToS) IDs Listener Port, Collection, and Retention Settings Collector Database Maintenance Reduce and Analyze Traffic with Advanced Filtering