Interface ‘0′ – What does it mean to you and your NetFlow stream?
Posted in NetFlow, NetFlow Analyzer, Network Traffic Analysis, Network Traffic Monitor on November 6th, 2009 by nathanh
I love that title. It sounds so dramatic.
I’ve been seeing this issue lately and I think it’s worth talking about, since I can imagine it affects the way you see flows within just about any NetFlow traffic analyzer.
Within a NetFlow v5 packet, there are two rows that define the inbound and the outbound interface for every conversation. Those interface numbers are really just the ifindex interface ID assigned by your router.
The inbound/outbound interface fields are crucial to being able to calculate where your traffic stream is going.
Lets look at a couple screenshots:
