Why are some of my interfaces in NFA not showing Out data?

Products

• CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

Some NFA interfaces are not showing Out data in NFA reports.

Environment

NFA Any Version

Resolution

 

1. Verify that the router is configured to send both ingress and egress data on the interface missing the OUT data. 

    This configuration can vary by device, IOS version, and Netflow version. See the link below for an overview on this:

     

What are the recommended Ingress and Egress Netflow/IPFIX settings for devices sending data to NFA?

 2. Even if the configuration looks correct, verify the you see the ifindex of the interface in question in the "OutputInt" field after decoding a pcap from the device with Wireshark. 

     

     You can follow steps 1-7 in the document below to use wireshark to capture the netflow data from the device and decode it:

How can I determine if a NetFlow enabled device is sending the correct fields and data using WireShark?

     

     Once decoded you can look for the "OutputInt" field within the Netflow data like below and see if the ifindex of the device is shown in any OutputInt field. 

     In the example below ifindex 2 should be showing Out data:

You can make it easier to find the ifindex you are looking for by right clicking on the OutputInt field above and select "Apply as Column" like below:

This will create a column on top of wireshark with every outputint ifindex value like below:

     

3. If you don't see the ifindex in the OutputInt field that you are looking for then there is an issue on the router side.

4. If you do see the ifindex in the OutputInt field, then reboot the Harvester Server, and wait 15-30 minutes and check the Last Hour data to see if Out data is now showing.

    We have found that when everything else checks out with NFA and the Netflow data that rebooting the Harvester will usually resolve this issue.