Hello
I have such kind of problem with stealthwatch.
I Configured flexible netflow on Cisco cisco WS-C3850 Version 16.3.8
I added 2 lines in flow record config
#match datalink mac source address input
#match datalink mac destination address input
Cisco output:
#show flow monitor TEST_IN cache
DATALINK MAC SOURCE ADDRESS INPUT: ****.**3F.405E
DATALINK MAC DESTINATION ADDRESS INPUT: ****.**06.99D8
Everything is ok I see Subject and Peer MAC addresses on a L3 Switch netflow cache.
Also I run packet capture on Stealthwatch Collector and everything fine information about MAC addresses comes to StealthWatch collector.
but Stealthwatch Cannot display any MAC addresses when I filter flows, not in web and not in management console
(FlexNetflow is activated on Vlan interface)
