Issue:
NFA showing double the volume/rate of expected data for interfaces with WCCP enabled.
Environment:
Any version of NFA.
Cisco devices with WCCP enabled on Netflow interfaces.
Cause:
There are several Cisco defects for various IOS versions that cause doublt the amount of Netflow to be sent from the device, including defects CSCsb21972 and CSCts49162
Resolution:
Contact Cisco Support to see if there is a patch or workaround for your device/IOS or disable WCCP on that interface.
Additional Information:
https://quickview.cloudapps.cisco.com/quickview/bug/CSCts49162