I have two 2900s on the edge at my office, one with a Verizon multilink frame relay and one with an att ppp multilink. they have hsrp between them. on the serial interfaces on both of them, I have ip fow ingress and ip flow egress. I don't have anything configured on their Ethernet ports.
in my mind, if I am at home uploading a file to an FTP server behind either of those routers, the source in "show ip flow top talkers" would be my home ip address on the Serial interface, and the destination would be the FTP server on the Ethernet interface.
if i'm a at home *downloading a file from that same FTP server, the source would be the FTP server IP on the Ethernet interface and destination would be my home IP on the Serial interface.
but i'm seeing the FTP server on the Ethernet interface as the source in "show ip flow top talkers" even when i'm uploading a file to the ftp server. in fact, on the Verizon router, I don't ever see the serial interface as a source in ip flow top talkers.the Ethernet interface is the source 100% of the time. on the ATT router, I rarely see the serial as a source. I would not expect to see it as a source on either router very often, because these circuits are mostly used for serving out websites (external users pulling bits from the websites to their homes). but I know for a fact last night that External IP X was pushing files to FTP Server IP Y for about 90 minutes. I see both IPs in the top talkers of the Verizon router during that time, but the FTP server is the source.
should I have ip flow ingress/egress configured on the Ethernet interface too? or am I thinking incorrectly about source and destination?
