I am sending Netflows from my 6500s to MARS. I seem to get a lot of events that have 0.0.0.0/0 as the source and a lot that show that address and port as the destination.
Are these broadcasts?
Also most of my Netflow events are "Sudden Increase in traffic to a port". I turned on Netflow processing a week ago yet a lot of the raw event still show the mean as 0.