Hello all,
I have a question regarding NetFlow and duplicate information. How does NTA deal with redundant data? Is it smart enough to recognize when it receives the same information from multiple sources?
For example, assume the following situation:
I have 3 Cisco switches between a workstation and my router. All 3 switches are sending netflow data to NTA. Let's say that I create 100mb of traffic to the router. Each switch reports that 100mb of traffic just entered and exited the switch. In the NTA summary, will it be summarized as 300mb of data (because 100mb was reported from 3 different sources)? Or is NTA smart enough to know that only 100mb of true data traversed the network?
Any insight into this would be appreciated. Thanks!