We are dealing with a Netflow issue where Solarwinds Netflow will sometimes displaying the conversation correctly and sometimes now. We have a citrix server at 172.21.4.142 and it listens on TCP 1494. We have a workstation at 10.250.239.156 and 172.21.49.66. You will see below that in one of the examples, things show up correct. With port 1494 as the port the workstation is talking to. But in the other example it shows up incorrectly with it showing the destination being the workstations port and that hte server talks from a random port, which is completely incorrect.
My theory is that on the incorrect example, the workstation is on a lower port than the server and Solarwinds Netflow is thinking that is probably the destination port (which is a bad guess to make).
How can we fix this?
Working Correct:
Working incorrectly:
