Submit a ticketCall us

Training ClassThe Orion® Platform Instructor-led Classes

Provided by SolarWinds® Academy, these trainings will introduce users to the Orion Platform and its features, management, and navigation. These courses are suitable for users looking to discover new tips, tricks, and ways to adapt their Orion products to better suit their monitoring needs:
Deploying the Orion Platform
Configuring Orion views, maps, and accounts
Configuring Orion alerts and reports

Reserve your seat.

Home > Success Center > Netflow Traffic Analyzer (NTA) > NTA - Knowledgebase Articles > Theory of Duplicate Flows

Theory of Duplicate Flows

Table of contents
Created by Brian O'Donovan, last modified by Brian Hansen on Nov 16, 2017

Views: 1,884 Votes: 3 Revisions: 8


If your device is not configured properly, data can be duplicated.


All NTA versions


Explaining duplicate flows


Due to the way the NTA application currently processes data we recommend to only have "ip flow ingress" enabled on the interfaces.


When a flow is received it contains the interface index numbers for both the Input and the Output interfaces.

NTA parses this out and applies the Ingress traffic to the Input interface and the Egress to the Output interface.

So depending on the configuration flows can look the same to NTA even though the flow is coming from two different interfaces.


For example:


A device with two interfaces with the following config:


Ip flow ingress

ip flow egress



IP flow ingress

ip flow egress


When a flow in coming into the serial interface the Ingress command will tag the serial in the Ingress direction and the Gig0/0 as the Egress direction.

When the same flow exits the Gig0/0 interface the Egress command is going to tag the Gig0/0 as the Egress and the Serial as the Ingress.

When these two flows are exported they will look the same to the Netflow collector

The rules of thumb are:

  • When only monitoring one interface on the device configure both “ip flow ingress and ip flow egress” on the interface
  • When monitoring multiple interfaces then only configure “ip flow ingress” on all interfaces.




Issue: Theory of Duplicate Flows diagram




Solution: Theory of Duplicate Flows Resolved


Last modified