[c-nsp] Traffic destined to IPs that are null routed, Netflow, and you!

[Drew Weaver]

                Hi,

I had an incident earlier this week where for "some reason" a large amount of traffic was being sent to an IP that wasn't routed in my network (was covered by the hold down).

Ultimately I found the source/dest of the traffic by simply routing all of the unused IPs to a server, and then used tcpdump.

My question is, is it normal for this 'hold down' traffic not to show up anywhere in Netflow?

thanks,
-Drew