Hi, I'm trying to calculate the bandwidth usage of to/from a specific host (for example 10.1.2.3) behind a FortiGate 100D. To do so, I'm using a Netflow v9 custom sensor on a PRTG (220.127.116.113 Core ad Probe on same host).
I've configured it with this include filter (exclude filter is empty) :
SourceIP[10.1.2.3] or DestinationIP[10.1.2.3]
It works as expected : Netflow sensor reports traffic to/from 10.1.2.3 and other hosts, except traffic between PRTG and this host.
It's really weird, because when I sniff traffic on the same interface of the FortiGate on which I've enabled Netflow, I can see a bunch of packets to/from PRTG and 10.1.2.3. Furthermore, PRTG's traffic is huge compared to traffic to/from others hosts, so the result from sensor's view is really impacted...
Is this a common behavior of Netflow (exclude traffic to/from collector) ? A misconfiguration ? An issue in PRTG ?