Question 740
At a regional network operations center in Bristol, a post-change check targets this documented issue: NetFlow statistics are empty for inbound traffic because the flow monitor was applied only in the outbound direction. Which observation is the strongest evidence that the repair worked?
Explanation
Correct Answer
This is the observable outcome for flow monitor interface direction. It tests whether the targeted change, 'Apply the correct monitor to the appropriate ingress or egress interface direction', actually resolved the reported issue at a regional network operations center in Bristol. The original failure was: NetFlow statistics are empty for inbound traffic because the flow monitor was applied only in the outbound direction.
Incorrect Answers
That observation verifies ipfix export compatibility in a different situation, such as when an exporter uses an IPFIX collector but the router sends an incompatible or incorrectly configured NetFlow format. For the reported flow monitor interface direction incident at a regional network operations center in Bristol, the required acceptance evidence is: Inbound flow counters increase for captured test traffic. This other result does not test that condition directly.
That observation verifies flow record key fields in a different situation, such as when a traffic analyzer needs conversations by source/destination IP and ports but the custom flow record does not match those keys. For the reported flow monitor interface direction incident at a regional network operations center in Bristol, the required acceptance evidence is: Inbound flow counters increase for captured test traffic. This other result does not test that condition directly.
That observation verifies flexible netflow exporter target in a different situation, such as when a flow monitor collects records locally but the collector receives nothing because its exporter destination is wrong. For the reported flow monitor interface direction incident at a regional network operations center in Bristol, the required acceptance evidence is: Inbound flow counters increase for captured test traffic. This other result does not test that condition directly.