Network Management

Theory of Duplicate Flows in NTA

If your device is not configured properly, data can be duplicated in egress/ingress charts.

First published date

10/19/2018 9:47 PM

Last published date

4/21/2025 5:11 PM

Overview

If your device is not configured properly, data can be duplicated in egress/ingress charts in NTA.

Explaining duplicate flows
Due to the way the NTA application currently processes data, we recommend to only have "ip flow ingress" enabled on the interfaces.

When a flow is received, it contains the interface index numbers for both the Input and the Output interfaces.

NTA parses this out and applies the ingress traffic to the input interface and the egress traffic to the output interface.

Depending on the configuration, flows can look the same to NTA, even though the flow is coming from two different interfaces.

Example

A device with two interfaces with the following config:

Serial0/0/0

IP flow ingress

IP flow egress

Gig0/0

IP flow ingress

IP flow egress

When a flow comes into the serial interface, the ingress command will tag the serial in the ingress direction and the Gig0/0 as the egress direction.

When the same flow exits the Gig0/0 interface, the egress command is going to tag the Gig0/0 as the egress and the serial as ingress.

When these two flows are exported, they look the same to the NetFlow collector

The rules of thumb

  • When monitoring only one interface on the device, configure both “ip flow ingress and ip flow egress” on the interface.
  • When monitoring multiple interfaces, only configure “ip flow ingress” on all interfaces.

Issue: Theory of Duplicate Flows diagram

Product section

Netflow Traffic Analyzer

Resolution

Theory of Duplicate Flows Resolved