Stealthwatch - Subject/Peer MAC address issue

LevanB — Tue, 06 Apr 2021 12:44:36 GMT

Hello

I have such kind of problem with stealthwatch.

I Configured flexible netflow on Cisco cisco WS-C3850 Version 16.3.8

I added 2 lines in flow record config

#match datalink mac source address input

#match datalink mac destination address input

Cisco output:

#show flow monitor TEST_IN cache

DATALINK MAC SOURCE ADDRESS INPUT: ****.**3F.405E
DATALINK MAC DESTINATION ADDRESS INPUT: ****.**06.99D8

Everything is ok I see Subject and Peer MAC addresses on a L3 Switch netflow cache.

Also I run packet capture on Stealthwatch Collector and everything fine information about MAC addresses comes to StealthWatch collector.

but Stealthwatch Cannot display any MAC addresses when I filter flows, not in web and not in management console

(FlexNetflow is activated on Vlan interface)

topic Stealthwatch - Subject/Peer MAC address issue in Security Analytics