Wrong flows appearing on interface

[meade470]

I have a small network with a simple config. Our router is configured as follows:

Global:
ip flow-export source Loopback1
ip flow-export version 5
ip flow-export destination 192.168.25.86 9996
ip flow-export destination 192.168.25.87 9996

All interfaces (2 physical and 3 subinterfaces) have "ip flow ingress" applied to them (the "ip route-cache flow" is deprecated in the IOS version).

I am seeing, on all interfaces, flows which shouldn't appear on the interfaces. For instance, if I view Host-to-Host on the 192.168.25.1 interface, I see:

Source IP: 192.168.40.2 Destination IP: (internet IP)
Source IP: 192.168.26.34 Destination IP: (internet IP)

This is occuring on an upgraded installation of Scrutinizer as well as a fresh installation of Scrutinizer on a test server. Any thoughts? Am I misunderstanding something?

Thanks

[BenjaminM]

What device is this?

[BenjaminM]

Hi Meade470,

I apologize for my vague response.

It sounds to me like you are seeing traffic that is ingress on the 192.168 interface with the internet being it's destination.

I am happy to look at this with you so we both understand what it is we are seeing here. Can we make that happen?

What type of hardware/OS are you running?

Can you send me the configuration for the 192.168.25.1 interface you are seeing this behavior on? Is 192.168.25.1 an interface or subinterface?

Is this behavior occurring on all of the interfaces from this device?

Thanks,
Ben