NetFlow settings

It is recommended to set active flow timeout to 5 minutes or less (instead of the default value of 30 minutes) for faster export of flow data (useful for Flowmon ADS and Flowmon DDoS Defender).

The minimal flow data required by Flowmon Collector:

Source IP address
Destination IP address
Source port number
Destination port number
L3 protocol
Start of flow timestamp
End of flow timestamp
Number of bytes
Number of packets
Transport TCP flags

Ingress/Egress on multiple interfaces

Usually, it is sufficient to enable collecting just inbound traffic (ingress) on all the interfaces of the switch.