NTA Adds NetFlow Sources but sources are not NetFlow Exporters

Wondering if anyone else has experienced an issue in NTA 3.6 with devices being added as NetFlow sources, but NetFlow export has not been configured on the device in question. I started noticing a few times a week, or particularly following a re-boot of the server that some devices showed up as never having exported NetFlow Data in the NetFlow Sources list. When I checked the device's configuration, it was not configured to send NetFlow to Orion, but was a managed device in NPM. Initially I figured that someone had removed the NetFlow export config from the router, but that is definitely not the case. I also noticed that some devices simply refuse to be removed from the NetFlow sources list, and keep coming back. I have verified the IP's are correct, and I'm not dealing with a duplicate IP somewhere.

I have opened a case- #146861, but thought I would see if anyone else noticed the behavior.

Find more posts tagged with

nta_3.6_netflow

Accepted answers

All comments

FormerMember

When ever we reboot, we get an event notice - "NetFlow Receiver Service [IBR1PNRAP017] is receiving a Netflow data stream from an unmonitored interface. " It happens anywhere from once to a few entries as the system comes up.

I suspect it is because NTA starts receiving data from the devices before the system is fully operational. The error only shows up once and doesn't return until the next reboot.

extrands

We have noted the same behavior, and reached the same conclusion as to the cause.

Donald_Francis

I noticed the same thing the day CBQOS was added. As far as I have noticed if it has QOS on the interface and you have auto add turned on it will add it as a netflow source. In fact I had to turn of auto add for that reason. It kept adding all my chassis switches as sources due to the use of QOS.

casonline

I've got the same issue... checked my devices and they are not configured for netflow/sflow...