[c-nsp] Netflow architecture

[Kanagaraj Krishna]

Hi,
   Currently we are using NTOP as a Netflow collector and our objective is to 
study our traffic pattern. Just curious whether Netflow information only 
represents traffic leaving an interface (outgoing) OR does it cater to vice 
versa as well (incoming and outgoing)? The reason for my doubts is that from 
the sample that were collected, it can be seen that more traffic were recorded 
on external destination IP/AS. My observation could be wrong, if yes please 
enlighten me. Thanks.

Regards,
Kana