Management
Reply
Contributor
juniper321
Posts: 78
Registered: ‎11-08-2011
0
Accepted Solution

flows are showing in reverse in STRM

source ip is showing as destination and destination as source...not sure what's the cause...anyone else seen it..

i was thinking my be asymetric routing or something but that should show as one sided flows ..not reverse..

if anyone has any insight into it, please share..TIA

Trusted Contributor
markpr
Posts: 70
Registered: ‎01-23-2008
0

Re: flows are showing in reverse in STRM

We have seen it too, but not recently, and we didn't nail down the cause.  Are you on STRM 2010 with one of the most recent patches?

Contributor
juniper321
Posts: 78
Registered: ‎11-08-2011
0

Re: flows are showing in reverse in STRM

yes i'm on 2010 with recent patches..

and it's not all the flows that are showing this way but most..some are showing correctly..i have no idea where to even look..i had a support case open but didn't really get anywhere..they made it sound like this was normal.

Super Contributor
srigelsford
Posts: 203
Registered: ‎04-14-2008
0

Re: flows are showing in reverse in STRM

I seem to remember something simular to this.

Under Admin, go into Flow Sources, and edit your source.

Untick the box 'Enable Asymetric Flows'.

 

This may be unrelated, I'm going back a couple of years...

 

Sam.

Trusted Contributor
markpr
Posts: 70
Registered: ‎01-23-2008
0

Re: flows are showing in reverse in STRM

And let us know if you can tie it to any particular type of flow source too. We have all type of flow types that we can look at and compare. It's obviously not related to release and patch level.

Contributor
juniper321
Posts: 78
Registered: ‎11-08-2011
0

Re: flows are showing in reverse in STRM

"Enable asymetric flows" is unchecked for all sources except jflow. i unchecked it for jflow as well and will watch it

it looks like syslog and dns flows are showing up in reverse

Contributor
juniper321
Posts: 78
Registered: ‎11-08-2011
0

Re: flows are showing in reverse in STRM

looks like that fixed the problem..thanks..much appreciated.

Copyright© 1999-2013 Juniper Networks, Inc. All rights reserved.