Flows Received on NTA Server But Not Processed

Version: Orion NTA 3.6 or higher

Explanation:

Assuming you have setup your device to export NetFlow to the Orion server, and you have verified with a packet capture tool that the flow packets are being sent from the device and arriving at the Orion server, the most likely cause of Orion NTA's failure to process flow packets is that the packets are not being written into the Orion database due to a firewall block.

Packet capture tools (for example, WireShark), operate on a lower level in the IP stack; so though the capture shows the packets successfully sent and received, the firewall can subsequently block their processing at the application layer, before Orion NTA can work on them.

Resolution:

If you are running a firewall on the Orion server, do the following:

Disable firewall on the Orion NTA server.
View the Orion NTA event log for a notification that Orion NTA is receiving flows from an unmonitored interface.
Click the link in the event log notification to add the device to NetFlow sources; alternatively, you can manually add the device through the NetFlow Sources resource.
Enable the firewall and create rule to permit flows from the relevant interface.

No related articles were found.

Attachments

No attachments were found.

Visitor Comments

No visitor comments posted. Post a comment

Post Comment for "Flows Received on NTA Server But Not Processed"

If this article does not provide the solution you need, please consider visiting our community forums on thwack or contacting SolarWinds Support. Please use the following form to provide comments that help us improve this KB article. Fields marked with an asterisk are required.