SD-WAN Control traffic appearing as a top talker in the Orchestrator for an edge.

Products

• VMware VeloCloud SD-WAN

Issue/Introduction

While looking at the Sources tab for an edge in the VCO, "SD-WAN Control" may appear at a top talker, consisting of a large amount of data. 

Cause

This is due to the way we label traffic displayed on the Orchestrator and a limit on how many different flows and types of traffic are sent to the Orchestrator from the Edge.  

The edges keeps track of metadata for different flows, which it then sends to the Orchestrator to display on the various tabs in the monitor section for an edge.  Once this data reaches 1/3 of the max flow count for a given edge model, the remaining metadata will be bundled as a single type of traffic, which we call Overflow traffic.  Traffic labeled as "Overflow" can be seen on the Monitor > Destinations tab in the VCO.

On the Sources tab, we label this traffic as "SD-WAN Control", and on the Applications tab it is seen as "Internet Protocol" application type.

 

Resolution

The way to confirm if this is really Overflow flow data, is to check the Destinations tab and only select "overflow", then compare the traffic graph to that to the "SD-WAN Control" traffic on the Sources tab.  The traffic graphs will be nearly identical, indicating what's seen on the Sources tab as "SD-WAN Control" is really this "overflow" data.  

 

 

To see the traffic that truly is SD-WAN Control, go to the Applications tab and only select the "SD-WAN Control" application, and compare to the Destinations tab with only "velocloud.net" selected.  We can see they have different traffic patterns than the above for Overflow traffic.