Same IP listed under Source IN and SourceOUT?

Same IP listed under Source IN and SourceOUT?

I apologize in advance for asking to define SourceIN, SourceOUT, DestinationOUT, and DestinationIN.

I know it has been asked and answered on that forum before but I can't make sense of a generated report I reviewed today: On that scheduled consolidated report for one interface, the tables SourceIN and SourceOUT list many of the same IPs, and so do the DestinationIN and DestinationOUT tables.

It doesn't make sense to me. If a given IP is the source of the traffic coming in (SourceIN), how can it also be the source of traffic going out (SourceOUT)? I mean, as a source of traffic, an IP has to be IN or OUT, not both, right?

Same goes for destinations: If an IP is the destination address for packets coming in (DestinationIN), how could it be a destination address for packets going out (DestinationOUT)?

As I understand it, an IP can only be on one side of the interface where netflow data is collected. So an IP could be listed as:
SourceIN and DestinationOUT
or SourceOUT and DestinationIN
but not SourceIN and SourceOUT (or DestinationIN and DestinationOUT) at the same time.

Anyway, I am probably missing something obvious.

I would appreciate it if somebody could take the time to explain how it works.

Thanks in advance.
















                New to ADSelfService Plus?