Layer 2 NetFlow Behavior in NTA

SolarWinds NTA only summarizes Layer 3 (IP-routed) traffic. This means you will only see traffic that passes between VLANs (inter-VLAN) or across routed interfaces — not traffic switched within the same VLAN.

On the term "Layer 2 NetFlow": You may encounter THWACK posts or blog posts referencing this term. It is a misnomer. What it describes is capturing Layer 3 traffic that happens to be processed on a VLAN interface — not true Layer 2 (MAC-level) visibility. NTA does not support Layer 2 traffic inspection regardless of how the device is configured.

There are two distinct reasons customers may see missing or no NetFlow data in NTA:

1. NTA does not process MAC-level fields NetFlow v9 MAC fields — IN_SRC_MAC (56), OUT_DST_MAC (57), IN_DST_MAC (80), OUT_SRC_MAC (81) — are not stored or processed by NTA. The same applies to equivalent IPFIX fields: sourceMacAddress (56), postDestinationMacAddress (57), destinationMacAddress (80), postSourceMacAddress (81). Flows must contain at minimum the required NTA fields to be processed.

2. NetFlow configured on a Layer 2 interface generates no records This is the most common real-world cause of "NetFlow not working" cases. On Cisco IOS/IOS-XE, if a physical interface is operating in switchport mode (Layer 2 trunk or access), the ip flow monitor command has no effect — the interface forwards traffic based on MAC/VLAN and never processes IP headers. NetFlow records are only generated where IP routing decisions occur.

Common Scenario: MPLS or ISP Handoff via VLAN Trunk

This design is widely used for WAN/MPLS connectivity and is the most frequent source of confusion.

Typical configuration seen in the field:

interface TenGigabitEthernet1/1/23
 description MPLS Circuit (ISP PE)
 switchport trunk allowed vlan 2
 switchport mode trunk
 ip flow monitor NETFLOW_MONITOR input    ← Has no effect — Layer 2 interface

interface Vlan2
 vrf forwarding WAN-VRF
 ip address xxx.xxx.xxx.117 255.255.255.252    ← Routing happens here

Why this fails: The physical interface is a Layer 2 trunk. Traffic enters it as tagged VLAN frames and is forwarded to Vlan2 where routing occurs. NetFlow never fires on the trunk because there is no IP processing at that point.

How traffic actually flows:

ISP / MPLS PE
      |
TenGigabitEthernet1/1/23   ← Layer 2 trunk — MAC/VLAN forwarding only
      |
Vlan2 (SVI)                ← Layer 3 — IP routing happens here
      |
Internal network

Enable NetFlow on the Layer 3 SVI, not the physical trunk interface:

interface Vlan2
 ip flow monitor NETFLOW_MONITOR input    ← Correct placement

If the SVI uses a non-default VRF (e.g., vrf forwarding WAN-VRF), verify your IOS/IOS-XE version supports VRF-aware flow export and that the exporter configuration is VRF-consistent.

Once applied, NTA will display:

• Traffic flows between your network and the ISP peer

• Source and destination IP addresses

• Application and port-level breakdown

• Flow-based bandwidth utilization

What Will Not Be Visible (By Design)

Quick Reference

Key Takeaway

NetFlow visibility depends on where routing occurs — not where traffic physically enters the device.