I recently configured our Sonicwall NSA4500 (5.8.1) appliance to export Netflow v9 to NTA 4.1.0 on its wan port. NTA now sees data coming in, but it appears to be completely wrong. For example, I can see the wan interface on the sonicwall pegged at 80% at 10Mbps for an hour, but if I go to see "who" or "what" is creating that bandwidth usage, NTA will show crazy low numbers like "90Kbps for last 15 min" on the same port. The total bytes transferred are also implausibly low. The "conversations" data does seem to be plausible.
That said, is this likely an issue with Sonicwall not reporting correctly, or might I have something configured wrong on either end? As a side note, I also have a Cisco 1900 router sending flow data to NTA and it is accurate, so I *think* NTA isn't the culprit here. It's as if the sonicwall is just sending over wrong data, or maybe data that is off by a factor of 100 or 1000 or something.
Anyone have a similar experience? Or does anyone have their sonicwall sending accurate flow data to NTA?