Live Traffic Analysis (LTA) provides helpful insight about tracing live traffic and bi-directional packet tracing. Traffic analysis monitors live traffic at a source or between source and destination along with the packet capture. You can identify bad flows between the source and the destination. If the packet counter of the certain flow at the source endpoint is much higher than the packet counter of the certain flow at the destination endpoint, packet drop may occur between two endpoints. Hence the flow is probably a bad flow which you can trace for further analysis. Thus traffic analysis is helpful in troubleshooting virtual network issues. You can find the number of packet enter or leave a port, and the unexpected packet drop.

Limitations

  • LTA supports only on the overlay-backed NSX-T Data Center environments.
  • LTA with packet capture is not supported on Edge interfaces.
  • LTA is not supported on T0 Active/Active setup.
  • LTA is not supported on Global Manager.
  • LTA cannot observe VMC components that do not belong to the NSX management domain, such as IGW.

Create a Session

To start a LTA session, click New session. For details, see Create a Live Traffic Analysis Session.

Session List

After you create a session, you can view the list of all the active sessions. The session persists only for one hour. The session status can be as follows:
Status Description
In Progress The session is collecting the results. Wait for the session to finish.
Realized Realized session is that session whose intent configuration is realized on the management plane.
Unrealized Unrealized session is that session whose intent configuration is yet to be realized on management plane.
Partial Finished Only partial session result is available. Some session results might have lost.
Finished After the session is finished, you can view the session for further analysis. You can also rerun, duplicate, or delete the session.
Cancelled The session is canceled by exception.
Invalidated The session is canceled proactively by the data plane service because of disconnection of the source port or the data plane service is down. Make sure that the source or destination port is not migrated or disconnected during the running LTA session and retry.
Timeout The session is timed out.

To view the latest status, click the Refresh icon. To perform the following tasks, click Actions menu and then click the required option.

Option Description
Rerun Run an existing session again. The session persists only for one hour.
Delete Delete an existing session.
Copy Path to Clipboard Get the path of the LTA configuration. You can use the copied path later. You can filter the LTA sessions using the copied path.

Session Details

After the session is finished, you can click the session ID link and perform the traffic analysis. You can view data under the Observations tab and the Packet Count tab.
Observations Tab Description
Delivered Total number of received observations for the traceflow round.
Dropped Total number of dropped observations for the traceflow round.
Physical Hop Count The sequence number is the traceflow observation hop count. The hop count for observations on the transport node that a traceflow packet is injected in can be 0. The hop count is incremented each time a subsequent transport node receives the traceflow packet. The sequence number of 999 indicates that the hop count could not be determined for the containing observation.
Observation Type The observation type can be Forwarded, Dropped, Delivered, Received, and Injected.
Transport Node The name of the transport node that observed a traceflow packet.
Component The name of the component that issued the observation.
Actions You can view details for certain traceflow observation like MAC details of a logical switch or segment.
Packet Count Tab Description
Component The type of the component.
Transport Node ID of the transport node that observed a traceflow packet.
Packets Received, Forwarded, and Dropped Number of traceflow packets that were received, forwarded, or dropped.