What are you seeing as the export interface index number on the PCAP?
The pcap "interface" displays like this: "pcapx0". So I guess its index number is 0? But it doesn't show up as an interface on the Dragonfly appliance, it only shows up when I discover the device with SolarWinds via SNMP.
Correction - the pcap index is actually 4. However, I was working with SolarWinds support on this and we confirmed that the Netflow is actually coming from eth0, which has an index of 2. When we examined some Wireshark captures of the Netflow data being sent to the Orion server, we didn't see this index number reflected anywhere. Instead, in the Wireshark trace, when we drilled down into the individual flows, we found the following (note the last two lines, in bold):
Timestamp: Aug 17, 2010 15:42:00.000000000
Data FlowSet (Template Id): 257
FlowSet Length: 948
NextHop: 0.0.0.0 (0.0.0.0)
The SolarWinds tech thought that one of these should represent the If index, which according to our SNMP discovery should be "2".
So that's where we're stuck now. I'm going to send SolarWinds some traces and some info about our Dragonfly nprobe collector and see if they can determine the problem.
The resolution, apparently, was that the Dragonfly engineers added a patch to their appliance that set the ifIndex for the different Netflows to a static value. When I checked the latest Wireshark traces, I saw that the ifIndex for each flow was indeed remaining constant (in this case 4), rather than changing with each flow. However, I'd been instructed by the Dragonfly engineers to have SolarWinds discover and monitor the eth0 interface on their appliance. But SolarWinds showed that the ifIndex for eth0 was 2, not 4. I ran another SNMP discovery of the Dragonfly box and found that ifIndex 4 belonged to a pcap interface called "pcapx0". Once I added that interface as a Netflow source, I started seeing the expected Netflow data.
So if anyone ever tries to use a Dragonfly nflow appliance with SolarWinds, that was our solution (at least the solution that's currently working for us).