Netflow on a Cisco 2821

[Thomas Summers]

I have  customer that we have configured netflow on the 2821 router that their traffic is on.  Currently the company they have contracted with for the analysis is seeing data duplication.  Below is the configuration for the interface and the router

Cisco 2821;

interface GigabitEthernet0/0

description TVC-FI-Ethernet-Fiber-Ethernet link

ip address 216.255.164.33 255.255.255.248 secondary

ip address 192.168.5.1 255.255.255.0 secondary

ip address 216.255.166.129 255.255.255.128 secondary

ip address 192.168.4.1 255.255.255.0 secondary

ip address 192.168.166.1 255.255.255.0 secondary

ip address 192.168.167.1 255.255.255.0 secondary

ip address 216.255.164.49 255.255.255.240 secondary

ip address 216.255.166.65 255.255.255.192 secondary

ip address 216.255.166.49 255.255.255.240 secondary

ip address 216.255.164.129 255.255.255.128 secondary

ip address 216.255.164.65 255.255.255.192 secondary

ip address 67.231.74.1 255.255.255.192 secondary

ip address 67.231.76.1 255.255.255.128 secondary

ip address 67.231.77.1 255.255.255.0 secondary

ip address 216.255.164.1 255.255.255.224

no ip redirects

ip flow ingress

ip flow egress

load-interval 30

duplex auto

speed 100

ip flow-cache timeout inactive 10

ip flow-cache timeout active 1

[Richard Burts]

Thomas

You have shown us one interface that enables NetFlow both in and out. But you have not told us whether there is any other interface on the router that also has NetFlow enabled. This could be a source of duplication and we need to know this.

HTH

Rick

Sent from Cisco Technical Support iPad App

[jakewilson]

Hi Thomas,

Make sure the export includes the "flow direction" element which indicates if the flow was metered ingress or egress.  Without flow direction, you will see the exact same flow twice.

There is a decent blog on our web site that helps explain ingress vs egress.

I hope this helps.

Jake