IBM Support

QRadar: Flows do not match expected traffic directions



After adding a flow processor to deployment, flows that are received do not have the expected directions. This might result in traffic that is expected as being Local instead appearing as Remote.


After a flow processor is added, flows are received but their direction does not match the expected results. IP Ranges might appear as remote even if they are configured in your network hierarchy.


When your deployment includes non-default domains, your network hierarchy can have non-default domain configurations. If the added flow collector is not assigned to the same domain as the IP range in question, that IP range will be recognized as a remote network.

Diagnosing The Problem

You can verify the domain configuration of the IP range in question by going to the following location on the QRadar User Interface: Admin > System Configuration > Network Hierarchy.

Resolving The Problem

To assign the flow collector to a domain, follow the procedure below:

  1. In the QRadar UI, select Admin > System Configuration > Domain Management.
  2. Select the domain in which the collector will be included and click Edit.
  3. From the Edit Domain screen, select Flows.
  4. Click Flow Collectors, find the added flow collector from the drop-down, and click Add.
  5. Click Save.

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Flows","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2;7.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018