mediumMultiple Choice
300-410 Practice Question: Configures NetFlow on a router using the legacy…
A network engineer configures NetFlow on a router using the legacy 'ip flow-export' commands. After applying 'ip route-cache flow' on an interface, 'show ip flow export' shows packets being sent, but the collector reports that all flows have a source IP of the router's management interface instead of the actual source IPs. What is the most likely cause?
⚠ Common exam trap
300-410 often tests the distinction between the source IP inside the flow record (monitored traffic) and the source IP of the export packet (transport) — candidates pick NAT or collector misconfiguration instead of the 'ip flow-export source' command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'ip flow-export source' command is set to the management interface, which becomes the source IP of export packets.
The 'ip flow-export source <interface>' command sets the source IP address of the NetFlow export packets themselves (the UDP packets sent to the collector). If it is configured to the management interface, every export packet will show that IP as the source — which is exactly what the collector is reporting. This is a configuration issue on the export transport, not a problem with the flow records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The 'ip flow-export source' command is set to the management interface, which becomes the source IP of export packets.
Why this is correct
The 'ip flow-export source' command fixes the source IP of export packets to the named interface, so all records reaching the collector appear to originate from the management address rather than the original flow endpoints. Removing or changing that source restores the true exporter address.
- ✗
The router is performing NAT on the flow data before exporting.
Why it's wrong here
NAT translates forwarded traffic, not the NetFlow export packets generated by the router's control plane, so it cannot rewrite flow source addresses. The management-interface source stems from the export transport's own source selection. NAT would be relevant when translating user data flows, not telemetry exports.
- ✗
The flow record is configured to match the router's interface IP as the source.
Why it's wrong here
Legacy NetFlow export does not inspect flow records to rewrite source addresses; the record's match fields describe observed traffic, not the export packet. The management-interface source arises from the export transport itself, so this option misattributes the cause. Flow record configuration would only matter when defining which fields are collected.
- ✗
The collector is misconfigured to display the export packet source instead of the flow source.
Why it's wrong here
Collectors display the flow fields the exporter sends; they do not substitute the export packet's source for the flow source. The management-interface address appears because the router sources its export packets from that interface, not because of collector display logic. Collector configuration governs parsing and presentation, not the flow data received.
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.