# Filebeat netflow module inverting source and destination on host behind nat?

**URL:** <https://discuss.elastic.co/t/filebeat-netflow-module-inverting-source-and-destination-on-host-behind-nat/253023>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 22, 2020, 2:51pm UTC](https://discuss.elastic.co/t/filebeat-netflow-module-inverting-source-and-destination-on-host-behind-nat/253023 "2020-10-22T14:51:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\
**Post date:** [October 22, 2020, 2:51pm UTC](https://discuss.elastic.co/t/filebeat-netflow-module-inverting-source-and-destination-on-host-behind-nat/253023/1 "2020-10-22T14:51:19Z")

</div>

Hello,

recently when I was working on a network problem I discovered the strange behavior of Kibana parsing the NetFlow docs.

I was looking for a top communication on the network and I noticed communication between host A and host B that stands out by a big factor.

When I check the dashboard kibana was saying that the communication was from Host A to B

But when I check the flow on BGP router I saw that the communication was from B to A.

Another Strange thing is that when I wanted to look by specifying the correct source address.  
This is the output.

 ![ead6a1a5d5c0d1bbd97b05b4d6b1e5cc7ddbad4d](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a544d4cc40a9ce70d723818d4a3ffca2653f94b7.png)

This is the output that shows the flow but in a direction that is not true.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4b61a9c992c983b285bddeeee1416f8eded10289.png)

I am sure that this problem is related to a lot of nat that is happening.  
The source host is being and as well as the destination host.

How can I debug this? So elastic search does now show me the flow that is in the wrong direction?  
Flow is sent from asa device and hosts are behind VPN.

---

<div class="post-metadata">

**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\
**Post date:** [October 22, 2020, 9:11pm UTC](https://discuss.elastic.co/t/filebeat-netflow-module-inverting-source-and-destination-on-host-behind-nat/253023/2 "2020-10-22T21:11:26Z")

</div>

So I have just triple check and It is behind double nat.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2020, 11:11pm UTC](https://discuss.elastic.co/t/filebeat-netflow-module-inverting-source-and-destination-on-host-behind-nat/253023/3 "2020-11-19T23:11:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.