You can verify that your QRadar Flow Collector is
operational and is capturing flows from routers or span ports.
Procedure
-
Check that you are collecting flows from all routers where the traffic might cross, especially
where multiple routes or paths exist.
If you are running dynamic routing protocols, traffic might follow different paths to and from a
host.
-
Ensure that span ports or taps are configured correctly to process both received and
transmitted packets.
-
Ensure that there is visibility to both sides of any asymmetric routes.