Security

source ip is showing as destination and destination as source...not sure what's the cause...anyone else seen it..

i was thinking my be asymetric routing or something but that should show as one sided flows ..not reverse..

if anyone has any insight into it, please share..TIA

We have seen it too, but not recently, and we didn't nail down the cause.  Are you on STRM 2010 with one of the most recent patches?

yes i'm on 2010 with recent patches..

and it's not all the flows that are showing this way but most..some are showing correctly..i have no idea where to even look..i had a support case open but didn't really get anywhere..they made it sound like this was normal.

I seem to remember something simular to this.

Under Admin, go into Flow Sources, and edit your source.

Untick the box 'Enable Asymetric Flows'.

This may be unrelated, I'm going back a couple of years...

Sam.

And let us know if you can tie it to any particular type of flow source too. We have all type of flow types that we can look at and compare. It's obviously not related to release and patch level.

"Enable asymetric flows" is unchecked for all sources except jflow. i unchecked it for jflow as well and will watch it

it looks like syslog and dns flows are showing up in reverse

looks like that fixed the problem..thanks..much appreciated.