User does not see all flows for a given source IP in Aria Operations for Networks (AON) / vRealize Network Insight (vRNI)

Products

• VCF Operations for Networks

Issue/Introduction

To prevent the system from being overwhelmed, AON / vRNI imposes a limit on the number of connections a client can establish. Flows exceeding this threshold are not displayed in UI. This protection mechanism is designed to mitigate the impact of rogue entities, such as network scanners that might probe every machine in the environment, which may exhaust the overall flow capacity.

• Limit for TCP flows: Allowed – 1000, Denied – 50 flows
• Limit for UDP flows: Allowed – 500, Denied – 50 flows

 

Running the following queries within AON / vRNI UI returns 1000, 50, 500 and 50 flows respectively:

• flows where Source IP Address = ‘x.x.x.x’ and Protocol = 'TCP' and firewall action = 'ALLOW'
• flows where Source IP Address = ‘x.x.x.x’ and Protocol = 'TCP' and firewall action = ‘DROP'
• flows where Source IP Address = ‘x.x.x.x’ and Protocol = ‘UDP' and firewall action = 'ALLOW'
• flows where Source IP Address = ‘x.x.x.x’ and Protocol = ‘UDP' and firewall action = ‘DROP’

Environment

VMware Aria Operations for Networks 
VMware vRealize Network Insight

Resolution

Workaround:

• If you believe you have encountered this issue, please open a support case with Broadcom Support and refer to this KB article.
  For more information, see Creating and managing Broadcom support cases.