Are there limitations on the ports that a netflow export actually exports? The reason I am asking is that we have been using a netflow collection system for a while and have been comfortable with it. It has seems to be reporting what we need. Today however I noticed something that I am trying to understand.
I applied an access list to an interface to liit traffic and added a log to make sure I have everything correct. I looking at the log there seemed to be a lot of traffic on port 5190 which seemes to be part of ALO stuff. I was courious about this traffic so pulled up my NetFlow collector and it is reporting that there has never been any traffic on this port that it recorded. I then started looking at the cache flow information and there does not seem to be any record for port 5190 as well. Unless it is happening so fast with single packets that it is rollling out of the cache I am just wondering where it is.
Anyone have any more thoughts on this??