My IPS is seeing the reserved address sent across my network, NTA tells when interfaces has seen the address, but when I click for details (what time it was seen on a link, how much traffic, port information etc.), it reports that it has never seen any data. I know there are at least 4 locations that have seen the address as a source, but without knowing which link it is currently active on (if not all of them) I can't isolate the source. This could be an issue with it's ability to report IANA reserved addresses (5.163.X.X), or it's ability to report NTP (port 123), that is the source and destination port my IPS is reporting.
Netflow is working properly, as I can see other flows just fine.