Hello
I have such kind of problem with stealthwatch.
I Configured flexible netflow on Cisco cisco WS-C3850 Version 16.3.8
I added 2 lines in flow record config
#match datalink mac source address input
#match datalink mac destination address input
Cisco output:
#show flow monitor TEST_IN cache
DATALINK MAC SOURCE ADDRESS INPUT: ****.**3F.405E
DATALINK MAC DESTINATION ADDRESS INPUT: ****.**06.99D8
Everything is ok I see Subject and Peer MAC addresses on a L3 Switch netflow cache.
Also I run packet capture on Stealthwatch Collector and everything fine information about MAC addresses comes to StealthWatch collector.
![stealthwatch packet capture.JPG stealthwatch packet capture.JPG](https://community.cisco.com/t5/image/serverpage/image-id/108221i938BAD1E03509401/image-size/medium?v=v2&px=400)
but Stealthwatch Cannot display any MAC addresses when I filter flows, not in web and not in management console
![stealthwatch.JPG stealthwatch.JPG](https://community.cisco.com/t5/image/serverpage/image-id/108222i61CA7CEABEAC5410/image-size/medium?v=v2&px=400)
(FlexNetflow is activated on Vlan interface)