Question

A network engineer configures Flexible NetFlow on R1 to identify top talkers per destination. The flow monitor is applied inbound on GigabitEthernet0/1, but when reviewing the cache with 'show flow monitor TOP-TALKERS cache', all traffic between two hosts is being aggregated into a single flow entry regardless of the transport ports and protocols used. The relevant flow record is configured as follows: 'match ipv4 source address', 'collect ipv4 destination address', 'collect transport source-port', 'collect transport destination-port', 'collect counter bytes'. What is the most likely cause of the aggregation behavior?

Accepted Answer

Only the source IP address is defined as a key field (match), so flows are keyed solely on source address while ports and destination are non-key collect fields.

Answer

The 'collect counter bytes' statement overrides the key fields, forcing all matching traffic into one flow.

Answer

The flow monitor must be applied in both directions to distinguish individual flows by port.

Answer

Flexible NetFlow does not support port-based flow differentiation unless IPFIX export is enabled.