SteelHead™ Deployment Guide : Virtual In-Path Deployments : Configuring Flow Data Exports in Virtual In-Path Deployments
  
Configuring Flow Data Exports in Virtual In-Path Deployments
The SteelHead supports the export of data flows to any compatible flow data collector. During data flow export, the flow data fields provide information such as the interface index that corresponds to the input and output traffic. An administrator can use the interface index to determine how much traffic is flowing from the LAN to the WAN and from the WAN to the LAN.
In virtual in-path deployments, such as the server-side of the network, traffic moves in and out of the same WAN interface; the LAN interface is not used. As a result, when the SteelHead exports data to a flow data collector, all traffic has the WAN interface index. Though it is technically correct for all traffic to have the WAN interface index because the input and output interfaces are the same, this makes it impossible for an administrator to use the interface index to distinguish between LAN-to-WAN and WAN-to-LAN traffic.
In RiOS v6.0 or later, the fake index feature is enabled by default if you enable the CascadeFlow export option. Prior to RiOS v6.0, or if you are using standard NetFlow, you can work around this issue by turning on the SteelHead fake index feature, which inserts the correct interface index before exporting data to a flow data collector. The fake index feature works only for optimized traffic, not unoptimized or passed-through traffic.
For information about how to configure fake index in the CLI in release prior to RiOS v6.0, see the appropriate version of the Riverbed Command-Line Interface Reference Manual or the SteelHead Deployment Guide.
Subnet side rules are necessary for correct unoptimized or passed-through traffic reporting. For details, see the SteelHead Management Console User’s Guide.
For information about exporting flow data, see Overview of Exporting Flow Data.