I configured netflow a router 1841, which have two Ethernet interfaces in work. on the interface FE0/1, I enabled netflow, on FE0, i didnt. but when I use my application to look the traffic, it shows the traffic on FE0/0. why?
description Connected to
ip address 10.X.X.5 255.255.255.0 secondary
ip address 10.X.X.5 255.255.255.0
description Connected to sib-b32-sw2 Fa0/8
ip address 10.x.x.202 255.255.255.252
ip route-cache flow
ip tcp adjust-mss 1400
crypto map abc-map
so you are using an external tool that collects netflow data exported by the router.
Be aware that among the exported data there are the following:
NetFlow Flows: Key Fields
A network flow is identified as a unidirectional stream of packets between a given source and destination-both are defined by a network-layer IP address and by transport-layer source and destination port numbers. Specifically, a flow is identified as the combination of the following key fields:
â¢Source IP address
â¢Destination IP address
â¢Source port number
>>>â¢Destination port number
â¢Layer 3 protocol type
â¢Type of service (ToS)
â¢Input logical interface
These seven key fields define a unique flow.
So even if netflow is enabled only on f0/1 you can see f0/0 on reports for sure if it is the only exit point from router to outside world.
the tool from the snmp ifindex = destination port number can easily show f0/0 on reports.
Notice that Joseph had explained this.
Hope to help
Yes, the command to activate flow cache on an interface also activates the netflow stats. However, there are other options for "managing" netflow stats, not shown in your partial config. These might impact what your "app" "sees".
Coming back to your original question, although you've only activated netflow on one interface, believe stats will note other interface used by flow (SrcIf and DstIf), although flow direction important (and dependent on other [later IOS] netflow configuration options).