There are a few things that could be causing this:
- Could those users be moving packets only within the LAN? If the traffic isn't routed across the device, it generally won't show up in the NetFlow packets exported from the router.
- It's possible that they are falling off the reports because they don't fall within the Top <X> selected at the top of the app. Even if you have it maxed out at Top 50, the 10 or so users representing the least traffic volume could be falling off the lists.
- It's possible that you might be monitoring the wrong interface; if you've got more than one LAN interface, you want to make sure to group them into an L3 VLAN and capture NetFlow from that VLAN interface.
Hope this helps.
Thanks for the response. I track by top 50, it's entirely possible these users are falling short of that range. They reside in the same VLAN as the rest of us and are certainly moving packets that should be picked up. With everything else functioning properly, I guess they just aren't active enough to be seen.