Bytes Out not getting captured in Netflow

[harsh.sharma]

Hi ,

we are facing a problem in net flow/IP Flow connector,it is like we are getting the bytes in filed inside the logs but not the bytes out field. Could someone help me with this.

[yaseen1]

I handled this by specifying the traffic direction on the net flow device. e.g. if the source is outside, then the traffic is inbound and if the source is inside then the traffic is outbound. It worked for me. 

[seniorj@bennett]

I'm having a similar problem, but I'm not sure what you mean by specifying the traffic direction on the netflow device: Is this a vendor-specific configuration, or a smartconnector/esm configuration?

[LakeHealthInfoS]

Its in the Net Flow configuration for the Cisco / Juniper / Enterasys device you can set directionality on the ingress and egress filter for Net Flow and it will determine directionality based off its configuration.

[seniorj@bennett]

Thanks for your reply, Christopher. I spent a few more hours on this problem yesterday.

I'm using NSEL netflow export from some Cisco ASAs.  It looks like the smarconnector isn't properly looking at the netflow template from the ASA for bytesin/bytesout count at all.

I ran some tshark sessions against it and the device is properly including the byte count, so this is certainly an arcsight issue.

Other devices of mine that generate netflow were including byte information just fine.

I'd almost file a bug request but those seem to just go to the ether =(