Reasons to have netFlow on both sides of a circuit?

Are you looking for bandwidth totals per school district or is there another reason why you capture the flow stats?

Another option you have is to do packet capture, setup a SPAN or mirror port and use this as a data source

We mainly use netflow to see bandwidth utilization down to the application layer. That way their IT department can tell if majority of the traffic is youtube, or from a legitimate video streaming site they use.

I just Netflow'd the closest interface to the NTA server on P2P links. The only stuff you would get from the other side would be the router-on-a-stick local inter-VLAN traffic, which would not bog down the WAN link, anyway. Our main business app was very latency-aware; so the WAN utilization was the main focus for us using NTA to monitor for users doing things that could bog down the WAN.

In the end, because we denied access to most streaming sites, the biggest culprit was patch Tuesday. We had to put local SCCM servers at the sites so the WAN links would get bogged down with several workstations getting patched all at once.

I hope this helps you.

Thanks you two.