Identifying top talkers and historical traffic volume for Native Load Balancer | VMware NSX

Products

• VMware NSX

Issue/Introduction

Native monitoring capabilities within the VMware NSX management plane are designed for real-time operational oversight rather than long-term data retention or granular flow accounting. Users frequently require the ability to identify top client talkers, cumulative data consumption per client IP, and historical port usage for specific Virtual Server (VIP) addresses. This article clarifies the architectural boundaries of native NSX-T Load Balancer statistics and identifies the required external integrations for high-resolution traffic analysis and per-client flow reporting.

Symptoms:

• Inability to generate "Top Talker" reports natively within the NSX Manager UI.
• Lack of historical traffic volume statistics for specific client IPs.
• Absence of cumulative byte counters per client IP in the load balancer connection tables.
• Requirement to identify destination port usage trends after a period of application downtime.

Environment

• VMware NSX 4.2.2

Cause

The NSX Manager local database is optimized for management and control plane operations. It does not store high-resolution historical data or maintain per-client byte counters.

Resolution

Natively, the NSX-T Edge appliance and NSX Manager provide only a transient snapshot of current active sessions. To achieve granular, historical reporting, use one of the following methods:

1. VMware Aria Operations for Networks (formerly vRNI): This is the primary tool for flow-based analysis. It utilizes IPFIX/NetFlow data to identify specific client IPs, traffic volumes, and destination port usage.
2. VMware Aria Operations: Use this tool to collect and store historical performance data, including active and dropped session trends for Virtual Servers over a defined retention period.
3. External IPFIX Collectors: Configure IPFIX on NSX-T segments to export flow data to a third-party collector. This enables custom reporting on top consumers and utilization trends.

To validate current active connections via the NSX Edge CLI:

1. Log in to the NSX Edge CLI.
2. Enter the following command to view all active session tables for a specific Load Balancer: get load-balancer <LB-UUID> session-tables
3. To filter the active sessions for a specific client or destination IP address, use the find parameter: get load-balancer <LB-UUID> session-tables | find ####.####.####.####