Question

A network engineer configured Flexible NetFlow on a WAN-facing GigabitEthernet interface to capture traffic destined to a remote data center. The flow monitor is applied and the collector receives records, but only traffic entering the LAN (returning from the data center) appears in the reports. Traffic sent from local clients toward the data center is missing entirely. The flow record correctly matches source/destination addresses and ports. What is the most likely cause?

Accepted Answer

The flow monitor is applied only in the input direction on the WAN interface, so it captures traffic arriving from the data center but not traffic leaving toward it.

Answer

The flow record is missing the 'collect counter bytes' field, so egress traffic is dropped from the cache.

Answer

The NetFlow export version is v9 instead of IPFIX, which does not support egress accounting.

Answer

The flow monitor cache timeout is too high, causing outbound flows to expire before export.