NetFlow Traffic Counts Are Lying to You. Here's How to Fix Them.

If your NetFlow dashboards show traffic volumes that don’t match capacity planning expectations, billing data, or your own intuition about what traverses the network, duplication is the most likely cause. It’s not a Datadog misconfiguration or a collector problem — it’s a structural artifact of how NetFlow records get generated at the network layer. Two independent mechanisms create duplicates, they often run together, and fixing one doesn’t fix the other.

The Framework

Address both root causes in sequence. The first is a device-level configuration fix; the second is a monitoring-layer filter strategy.

Root Cause 1: Ingress/Egress Recording

When a device monitors both directions of traffic on the same interface, every packet creates two records — one for arrival, one for departure. Identical traffic appears twice in your aggregate counts.

Fix: Configure NetFlow to monitor only egress interfaces. This is a per-device setting in your router or switch configuration. If your aggregate volumes are running approximately double what they should be, this is almost certainly the cause — and it eliminates the duplication completely.

Root Cause 2: Multi-Exporter Overlap

Traffic traversing multiple network hops generates a separate NetFlow record from each device it passes through. A conversation that moves through a switch, a router, and a firewall before reaching its destination produces three records in your collector — all describing the same flow.

This can’t be eliminated at the source because it’s structural: every device that handles the flow legitimately reports it. Two approaches address it at the monitoring layer:

Selective monitoring. Enable NetFlow only on specific high-value devices — border firewalls, core routers, internet-facing edge devices — rather than every device in the topology. This limits the exporter count and reduces duplication, but you lose visibility into traffic patterns on devices you don’t monitor.

Device role tagging. Tag your devices by role in Datadog’s Network Devices UI (Device Settings → Tags): device_role:border, device_role:core, device_role:spine. Filter your dashboards to show one role at a time — border devices for internet-bound traffic, spine switches for internal east-west traffic. Full monitoring coverage is preserved; dashboards show one authoritative source per traffic type.

For most environments, device role tagging is the better default: it doesn’t sacrifice coverage and the Datadog UI makes it operationally straightforward.

Where It Doesn’t Apply

For traffic crossing multiple sites or running through redundant paths, duplication can’t be fully eliminated by either approach. In these cases, designate an authoritative device per flow path — the geographically-tagged border device for cross-site traffic, the specific router segment that sees each flow type once — and build dashboards around those authoritative sources rather than aggregates.

Some duplication is structural. The goal is eliminating the preventable portion, not achieving zero duplication across every topology.

Source: Datadog Blog

Content created with AI assistance and reviewed for accuracy.