I'd like an explanation on the NTA traffic direction. From below, you can see two hosts - 10.10.100.165 and the xxxx.amazonws.com host. Now, from the looks of the arrows it appears that all traffic in the "Conversation Traffic History" is moving from the 10.10.100.165 host to the amazonws.com host. But I know this isn't true.
This has been a real PITA for us in using NTA as it never seems to show bidirectional traffic. Even switching from "Ingress" to "Egress" doesn't change the arrows.
Can someone explain to me if there is a way to see the actual source and destination information?
Is the exporter a Cisco device? If so, what's the interface flow configuration look like? What does the flow cache ("show ip cache flow") have to say about the same flows?