Reading SolarWinds NTA Top-Talkers Reports
A top-talkers report is often the first screen a network engineer opens when someone rings to say “the internet feels slow.” That makes it powerful — and easy to misread. This guide walks through every column, the gotchas that trip up newcomers, and the decision tree you should run when the numbers look wrong.
What NTA is actually showing you
SolarWinds Network Traffic Analyser (NTA) receives NetFlow, sFlow, or IPFIX exports from your routers and switches, reassembles them into flows, and aggregates those flows into the views you see in Orion. The top-talkers widget is one aggregation: it ranks endpoints or conversations by volume (bytes) or rate (bits per second) over whatever time window you select.
Two things to internalise before touching any report:
-
NTA shows sampled data. Most switches and routers export one-in-N packets. At 1:1000 sampling, a host sending 1 Gbps looks like 1 Mbps in the raw flow records. NTA applies a multiplier to compensate, but the figure is an estimate, not a measurement. SolarWinds documents this in the SolarWinds NTA Administrator Guide under “Understanding Sampled NetFlow.”
-
The time window dominates everything. A 15-minute window can show a short burst that a 24-hour window buries entirely. When someone says “we had a spike at 9 am,” switch the window first before drawing conclusions.
Anatomy of the top-talkers view
Navigate to My Dashboards → NTA Summary (or whatever dashboard your team has configured) and find the Top XX Talkers widget. It typically renders as a table with a bar chart alongside.
| Column | What it means | Common confusion |
|---|---|---|
| Endpoint / IP | Source or destination address, resolved to hostname if DNS is configured | Unresolved IPs often mean reverse-DNS is missing; don’t assume the host is unknown |
| In / Out (Mbps or GB) | Traffic into and out of the interface the flow was exported from | Direction is relative to the exporting interface, not the host |
| Total | Sum of in + out for that endpoint | Bidirectional transfers are counted twice — a 100 MB file transfer looks like 200 MB |
| % of Total | This endpoint as a fraction of all traffic in the window | Percentages add to more than 100 % if the denominator is interface total, not conversation total |
| Protocol | Grouped by application when NBAR or port-map data is available | ”Unknown” is normal; it means no app signature matched, not that traffic is malicious |
Note: If your endpoint column shows raw IPs rather than hostnames, check Settings → NTA Settings → DNS Resolution in Orion. Resolving at display time rather than ingestion time is the default and can cause blank names when DNS is slow.
A sensible order of investigation
1. Set a meaningful time window
Before reading any numbers, pick a window that matches the complaint. A user saying “it was slow this morning” — use the last 2 hours or a custom range covering 07:30–09:30. The default “last 60 minutes” is almost never the right choice for retrospective analysis.
SolarWinds NTA retains full-resolution flow data for a configurable retention period (a common default is 30 days; check Settings → NTA Settings → Data Retention on your NTA 2026.2.x install, current as of July 2026). Older data is rolled up to hourly averages, so granular drill-down past the retention window is not possible.
2. Look at absolute values, not just rank
The top talker at position one is not automatically a problem. A backup server legitimately consuming 400 Mbps on a 10 Gbps link during an overnight window is boring. The same server at 400 Mbps on a 100 Mbps WAN link during business hours is an outage.
Cross-reference the ”% of Total” column against your link capacity. If the top talker is consuming less than 10 % of a healthy link, the report is not where your problem lives.
3. Check the conversation, not just the endpoint
Click any IP in the top-talkers table to pivot to the Top Conversations view for that endpoint. This shows you who it was talking to, which is almost always more useful than knowing how much it sent in aggregate.
A single destination account for 90 % of an endpoint’s traffic? That is a very different story from traffic spread evenly across a hundred peers.
4. Identify the application
In the conversation view, look at the Application / Protocol column. If NTA has NBAR integration or a port-to-application mapping configured, common applications are labelled. If you see:
- Backup or replication protocol (e.g. NBT, iSCSI, rsync port 873) during business hours — schedule it out of hours or rate-limit it.
- Video streaming (e.g. Netflix, YouTube via NBAR) from a single endpoint — policy question, not a network fix.
- Unknown, port 443 or port 80, high volume — could be legitimate SaaS, could be data exfiltration. Worth a packet capture if the host is unexpected.
- DNS or NTP consuming meaningful bandwidth — almost always a misconfigured or compromised host generating amplification traffic.
5. Establish a baseline
A top-talkers report is only useful if you know what normal looks like. NTA’s Baseline feature (available from the NTA Summary dashboard, time selector dropdown) overlays historical average traffic for the same period over the previous N weeks. If Monday’s 09:00–10:00 traffic is 30 % above the rolling average for Monday mornings, that is a lead worth following.
If you do not yet have a baseline (common in fresh deployments), make a note of the current report and check it again at the same time next week. Three to four weeks of consistent data is enough to establish a rough normal.
Acting on what you find
The top talker is a backup or replication job
Action: Reschedule using your backup software’s maintenance window settings, or apply a traffic-shaping policy on the router (CBWFQ or a simple rate-limit on the relevant DSCP class). Confirm in NTA after the next scheduled run.
The top talker is an unexpected internal host
Action: Identify the host (reverse DNS, Orion’s Node Details page, your CMDB). Check whether the traffic volume is new by switching the NTA window to the past 7 days — the trend chart will tell you whether this is a long-standing pattern or a new behaviour. If new and unexplained, escalate to the security team; a compromised host generating large outbound flows is a real possibility.
The top talker is a legitimate server under heavy load
Action: This is a capacity question, not a traffic question. Check the server’s own metrics (CPU, disk I/O) in Orion’s Node Details view. If the server is healthy and the traffic is expected, the link may be undersized. Produce a bandwidth utilisation report from Reports → All Reports → Monthly Interface Traffic to build the business case.
The top talker is unknown / unresolved IP
Action: First, fix DNS resolution (see the note above). If the IP genuinely does not resolve — try a manual nslookup or check your IPAM — cross-reference against your subnet inventory. An IP outside your known ranges on an internal interface is a serious finding.
Nothing looks wrong but users still complain
Action: Top talkers measure volume, not latency or loss. A link can be lightly utilised and still deliver poor application performance because of packet loss or high RTT. Switch to Orion’s NPM interface details view and check error/discard counters, then run a path trace or use Orion’s IP SLA features if available.
Common mistakes
Treating percentage as absolute. A host at “45 % of traffic” on a 1 Gbps link is not a problem; 45 % on a 5 Mbps backup link is. Always convert to Mbps or GB.
Ignoring the export source. If your router exports flows from its WAN interface only, you will never see east-west server traffic. Check NTA Settings → Flow Sources to understand what is and is not covered.
Over-sampling false positives. High sampling ratios (1:4096 or higher) create statistical noise in the top-talkers view. A host that appears in the top five on a highly sampled interface may simply have been unlucky in which packets were sampled. Trust 1:512 or better for meaningful rankings.
Looking at the report once. Top talkers need context: is this the same pattern as last Tuesday? NTA is most useful as a comparative tool.
FAQ
What is the difference between NTA’s top-talkers view and the NPM interface bandwidth graph? NPM shows total interface utilisation — bytes in and out per interval. NTA breaks that utilisation down by who is sending the traffic. Use NPM to spot that a link is busy; use NTA to find out why.
Why do my top-talker percentages add up to more than 100 %? The denominator NTA uses is usually total interface bytes, and the widget may count both directions separately per endpoint. A host with 30 % inbound and 25 % outbound traffic appears to account for 55 % of a uni-directional metric. This is expected behaviour, not a bug.
How far back can I drill into flow data? Full-resolution flow records are kept for the period configured under Settings → NTA Settings → Data Retention (a common default is 30 days). Beyond that, NTA retains rolled-up hourly summaries. The exact limits depend on your NTA version and database sizing.
My top talker is a domain controller — is that normal? Often yes, particularly for Kerberos, LDAP, and DNS traffic across many clients. Check the conversation view: if traffic is spread across hundreds of client IPs to port 88/389/53, it is normal DC behaviour. If it is concentrated to a small number of IPs on unusual ports, investigate further.
Can I export the top-talkers data for a report? Yes. From the NTA Summary dashboard, click the widget’s three-dot menu → Export to CSV, or schedule a report from Reports → All Reports → NTA Top Talkers and email it to stakeholders.
NTA shows an IP I don’t recognise — where do I start? Run a reverse DNS lookup first. Then check your IPAM or DHCP logs for that address at the relevant time. If the address falls outside your documented ranges, treat it as a security incident until proven otherwise and involve your security team.
Sources & further reading
- SolarWinds NTA Administrator Guide — official reference for flow source configuration, data retention, and DNS resolution settings.
- SolarWinds NTA release history — version-specific changes to the top-talkers and dashboard views (current release NTA 2026.2.1, as of July 2026).
- SolarWinds THWACK Community — NTA board — peer discussion on sampling ratios, export configuration, and report customisation.
- Cisco NetFlow Configuration Guide — if your flow source is a Cisco device, this covers sampled vs full NetFlow and how sampling ratios are set on the exporter.
- Related tool overview: SolarWinds Orion Platform.