Submit a ticketCall us

Get a crash course on Network Monitoring delivered right to your inbox
This free 7-day email course provides a primer to the philosophy, theory, and fundamental concepts involved in IT monitoring. Lessons will explain not only how to perform various monitoring tasks, but why and when you should use them. Sign up now.

Home > Success Center > Netflow Traffic Analyzer (NTA) > Theory of Duplicate Flows

Theory of Duplicate Flows

Table of contents
Created by Brian O'Donovan, last modified by Daniel Polaske on Apr 07, 2017

Views: 124 Votes: 2 Revisions: 7


If your device is not configured properly, data can be duplicated.


All NTA versions


Explaining duplicate flows


Due to the way the NTA application currently processes data we recommend to only have "ip flow ingress" enabled on the interfaces.


When a flow is received it contains the interface index numbers for both the Input and the Output interfaces.

NTA parses this out and applies the Ingress traffic to the Input interface and the Egress to the Output interface.

So depending on the configuration flows can look the same to NTA even though the flow is coming from two different interfaces.


For example:


A device with two interfaces with the following config:


Ip flow ingress

ip flow egress



IP flow ingress

ip flow egress


When a flow in coming into the serial interface the Ingress command will tag the serial in the Ingress direction and the Gig0/0 as the Egress direction.

When the same flow exits the Gig0/0 interface the Egress command is going to tag the Gig0/0 as the Egress and the Serial as the Ingress.

When these two flows are exported they will look the same to the Netflow collector

The rules of thumb are:

  • When only monitoring one interface on the device configure both “ip flow ingress and ip flow egress” on the interface
  • When monitoring multiple interfaces then only configure “ip flow ingress” on all interfaces.




Issue: Theory of Duplicate Flows diagram




Solution: Theory of Duplicate Flows Resolved


Last modified
08:31, 7 Apr 2017