I send some TCP SYN packets and check the corresponding NetFlow (V5) records from 7609.
When the TCP destination port is 80, all the TCP flags of NetFlow records are zero.
When the TCP destination port is 445, all the TCP flags of NetFlow records are 2.
The only difference between the two sets of TCP SYN packets being sent is the TCP destination port.
The Cisco's documents say that the TCP flags of NetFlow (V5) on 7609 are always zero for hardware-switched flows.
Is there any association between the TCP destination port and hardware/software switching?
Any idea will be appreciated, thanks.
