Good day,
I am trying to monitor some enterprise traffic with a Cisco 9500 Switch (Software 17.4.1) as exporter and nfcapd/nfdump as collector. It works fine with one issue: The Duration of the flows is always 60s (or sometimes more). The Last Seen timestamp is also always 60 seconds later than the first seen timestamp. It seems like it depends on the set active timeout, this is currently set to 60 seconds, if I set it to 120 seconds all flows are now 120s long. The inactive timeout is set to 10 seconds. I have attached an example of netflows.
I have spent the last week trying to find the error, but without success. This specific problem does not seem to have been discussed on the Internet yet. I am glad about any suggestion.
