NTA consists of the Network Traffic Collector (NTC) and the Network Management Console (NMC).
1. NTC performs the following functions:
Receives and resolves various network traffic packets.
Collects and saves original packets.
Analyzes multi-dimensional traffic based on application, host, conversation, and DSCP.
2. NMC performs the following functions:
Stores network traffic data.
Collects data.
Provides user-defined reports.
Audits traffic.
NTA has the following characteristics:
1. Displays real-time traffic data.
2. Detects abnormality.
3. Supports network planning.
Displays Real-time Traffic Data
NTA has a customized Dashboard that displays real-time network traffic from multiple dimensions. For example, you can view the following information:
1. Interfaces that are used most often
2. Hosts that generate the highest traffic
3. Applications that consume the most network bandwidth
4. Areas that experience network congestion
5. Top N application during a certain period
Detects Abnormality
NTA analyzes original traffic and provides information that helps administrators audit abnormal traffic.
Supports Network Planning
NTA detects traffic trends and provides reference information in user-defined reports that administrators can use for network capacity planning.
Feature List
| Feature
|
Description
|
| Protocols
|
Supports the following protocols: NetStream, sFlow, NetFlow
|
| Network traffic display
|
1. Supports the ranking of interface traffic, interface usage, application traffic, protocol traffic, source host traffic, destination host traffic, conversation traffic, and DSCP traffic.
2. Allows you to customize the display form, the display content, and the content arrangement.
|
| Multi-dimensional network traffic analysis
|
1. Supports analysis of interface traffic, application traffic, source/destination host traffic, DSCP traffic, and conversation traffic.
2. Allows you to group network traffic, including interface group traffic, IP group traffic, DSCP group traffic, and application group traffic.
|
| User-defined report
|
Allows you to choose interface, specify filtering rules, report type, scheduling time, and report name, and configure report layout and statistics indexes.
|
| Traffic auditing
|
Supports original traffic analysis to locate faults.
|
NTA supports various protocols, including NetStream, NetFlow, and sFlow. You can do the following:
1. Customize the Dashboard to view the network status.
2. Customize traffic applications and group network traffic (IP traffic group, interface traffic group, DSCP traffic group, application traffic group). Network administrators can obtain useful traffic statistics results.
3. Monitor multi-dimensional traffic through simple configuration.
4. Customize the traffic report.
5. Audit traffic.
Customized Dashboard
Figure 1 Dashboard
You can customize the dashboard (as shown in Figure 1) to do the following:
1. Rank interface traffic, interface usage, application traffic, protocol traffic, source host traffic, destination host traffic, conversation traffic, and DSCP traffic.
2. Display the form, content, and content arrangement, according to your preferences. NTA displays traffic information in wedges on the window. You can refresh a wedge without changing the whole window.
3. Summarize interface traffic information, including the input rate, output rate, input packet quantity, and output packet quantity.
4. Click a specific interface to learn about the traffic composition of the interface from multiple dimensions such as application, host, conversation, and DSCP within a certain period.
Customize Traffic Applications and Group Network Traffic
You can customize traffic applications and group network traffic, as follows:
User-defined applications
User-defined DSCP group
User-defined application group
User-defined IP group or interface group
User-defined Applications
NTA identifies applications based on protocol and port number. NTA presets more than 4500 standard and common Layer 4 applications. For unknown applications, NTA automatically adds the applications based on protocol and port number. Generally, you do not have to add any applications.
Network administrators can add applications as needed. You can add applications by choosing the protocol, port range and IP address range. For example, the TCP protocol and port 443 indicate HTTPS applications. If the email system of an enterprise uses port 443, network administrators can create a mail application based on the IP address range of the email system. When receiving TCP/443 packets, the system resolves the data in the IP range to the mail application, and resolves other packets to HTTPS applications.
User-defined DSCP Group
DSCP group is a logical group. You can create a group to differentiate DSCP composition. For example, in WAN QoS monitoring, you can create a voice group (EF), a video group (AF31), and a group of the other DSCP. Therefore, NTA can provide reference for proper QoS bandwidth planning and key services bandwidth of the enterprise.
User-defined Application Group
You can create application groups as needed to obtain comprehensive information of specific applications. For example, you can create an application group named Mail Service, and combine Lotus Notes, pop3, and SMTP applications into the group to learn about the traffic of mail applications.
User-defined IP Group or Interface Group
Consider the IP addresses/interfaces in a certain range as a whole to calculate traffic statistics. For example, an enterprise has two floors. When calculating the total traffic of the enterprise, combine all the switch interfaces on the two floors into an interface group, and analyze the total traffic.
Monitor Multi-dimensional Traffic
Overall network traffic analysis depends on high performance traffic analysis. Network administrators only need to add a monitoring interface and configure the traffic sampling ratio. Then they can monitor and analyze traffic of the interface from multiple dimensions, including the following:
Interface traffic analysis
Application traffic analysis
Source/destination host traffic analysis
DSCP traffic analysis
Conversation traffic analysis
Note: You can analyze traffic on the traffic trend diagram, which supports double-axis display: traffic/packets.
Interface Traffic Analysis
Figure 2 Interface Traffic
As shown in Figure 2, interface traffic analysis checks the trend of traffic for a specified interface, time range, and incoming/outgoing traffic. Through interface traffic analysis, network administrators can identify the interfaces that are used most often on the network, and this gives them a comprehensive understanding of the whole network status. Administrators can find interfaces with abnormal traffic in time and locate faults before network performance is reduced.
Application Traffic Analysis
Figure 3 Application Traffic
Application traffic analysis checks the trend of application changes for a specified interface, time range, and incoming/outgoing traffic, as shown in Figure 3. Administrators can locate the host that causes performance problems based on the ranking of source and destination hosts using a specific application.
Source/Destination Host Analysis
Source/destination host analysis checks the trend in changes of source/destination host bandwidth usage for a specified interface, time range, and incoming/outgoing traffic. Through source/destination host analysis, network administrators can identify the host that consumes a high bandwidth. Then they can solve any bandwidth problems in time to ensure bandwidth usage efficiency.
Conversation Traffic Analysis
Conversation traffic analysis checks the trend of conversation traffic for a specified interface and time range. It provides detailed conversation information that the network administrator can use for further fault location.
DSCP Traffic Analysis
DSCP traffic analysis displays the trend of DSCP traffic for a specified interface and time range. Therefore, you can plan QoS bandwidth properly to ensure the quality of key services.
Group Traffic Analysis
Group traffic analysis displays the traffic statistics of DSCP group, interface group, application group, and IP group on specified interfaces within specific time range. It is convenient for network administrators to analyze specific traffic as needed to satisfy special maintenance needs.
Customized Traffic Report
NTA can customize reports in guide mode by specifying filtering rules, report type and report layout configuration, as shown in Figure 4. Traffic reports provide references for further network planning.
Figure 4 Create Report
Traffic Auditing
As shown in Figure 5, NTA can extract an original data stream according to a specified time range and filtering rules for further analysis and fault location.
Figure 5 Traffic Auditing
