Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Does netflow still have trouble with duplicate data from multiple sources

We're about to start monitoring netflow here and I remember from a few years ago that NTA didn't de-dup data coming from multiple sources. Is this still the case?

And if so, is there an easy way to just limit the data displayed to just one netflow source? Nothing leaped out and slapped me in the face from the flow navigator.

Thanks in advance.

Find more posts tagged with

Accepted answers

sean.martinez

NetFlow Traffic Analyzer will process all flows. Currently it does no do any de-duplication data purging.

When you select the Interface on any NetFlow collected source in the Web Console, it will show the NetFlow traffic specific to the Physical or Virtual interface with NetFlow configured.

All comments

sean.martinez

NetFlow Traffic Analyzer will process all flows. Currently it does no do any de-duplication data purging.

When you select the Interface on any NetFlow collected source in the Web Console, it will show the NetFlow traffic specific to the Physical or Virtual interface with NetFlow configured.

rschroeder

You're worried about two or more routers or Layer 3 switches reporting the same information twice (or even more than twice if the flow passes through multiple routing interfaces), effectively making your network appear more busy than it is in reality.

NTA does not de-duplicate, as far as I'm aware of, yet.

You might use some logic to limit how far off your flow data drifts by being picky about which interfaces report ingress vs. egress traffic. It's not a perfect solution, but may limit the over-reporting.

It's possible you may wish to NOT include Netflow configuration in certain interfaces at all, which can help manually prevent duplication.

In a typical Access Switch > Distribution Switch > Core Router > WAN router > WAN router > Distribution Switch > Access switch one-way path between to clients across a WAN, you might only want to report Ingress traffic on any SVI or routed interface or sub-interface. That maintains your flows and captures the end node information.

If you limit the Netflow to Ingress on the uplink ports on the Distribution switches and WAN routers you've gone a long way towards deduplication.

On the other hand, it would be convenient to apply Netflow settings to EVERY layer three interfaces and capture both Ingress AND Egress. That's the path to "all the data". It's simultaneously the path to the most duplication.

Systems will become smart enough to assign flow identifiers that can be deduplicated based on src-dst nodes and allow filtering and automatic deduplication one day. I hope.

allanseyberth

Thank you both gentlemen - I'm working with a network eng who is used to who a different product works. Wanted to verify all of this before reporting back.