NTA (NetFlow Traffic Analyzer)

Last updated: 2026-05-24

NTA collects NetFlow, sFlow, jFlow, and IPFIX records from network devices and shows who is consuming bandwidth — by host, application, protocol, or conversation.

What it is

NetFlow Traffic Analyzer (NTA) is the SolarWinds Orion module that ingests flow records from network devices and turns them into usable traffic analysis. Where NPM tells you an interface is at 80% utilization, NTA tells you why — which hosts are talking, which applications are responsible, which conversations are dominating.

NTA receives:

• NetFlow v5 and v9 (Cisco's original flow format and its more flexible successor).
• sFlow (sampled flow, used by many non-Cisco vendors).
• jFlow (Juniper's variant).
• IPFIX (the IETF-standardized flow format).

Devices export flow records to the NTA collector (the Orion server, by default on UDP 2055 or 9995 depending on protocol). NTA stores them in a high-volume database and exposes them through the Orion Web Console and SWIS.

What it monitors

• Top talkers — hosts sending or receiving the most traffic.
• Top conversations — pairs of hosts that talk a lot.
• Top applications — by port, by DSCP, by application-recognition (CBAR / NBAR on Cisco devices).
• Bandwidth utilization breakdown per interface, per direction, per app.
• Historical traffic patterns for capacity planning.

What PocketNOC shows from NTA

PocketNOC's interface detail screens surface NTA data where it's available — top talkers per interface, application breakdown, recent traffic patterns. Auto-detected: if NTA is licensed and the interface has flow data, the panel appears.

See also

• NPM — interface-level monitoring NTA complements.
• Orion Platform.