Question

A network engineer configures NetFlow on a Cisco Nexus 9000 switch to analyze traffic patterns for capacity planning. After applying a custom flow record, the collector receives flow entries, but flows that share the same source IP, destination IP, and protocol but differ only by TCP port are being aggregated into a single flow entry instead of being tracked separately. Which change to the flow record configuration resolves this issue?

Accepted Answer

Add the Layer 4 source and destination ports as match (key) fields in the flow record

Answer

Add the Layer 4 source and destination ports as collect (non-key) fields in the flow record

Answer

Increase the active flow timeout so ports are exported before aggregation occurs

Answer

Change the exporter version from NetFlow v9 to IPFIX to enable per-port granularity