Deduplication
If your JSA deployment includes multiple Flow Processors that provide data to a Flow Processor, you can configure flow deduplication to remove duplicate flows. The flow deduplication process ensures that flow records with the same unique identifier are reported only once.
Before discarding the duplicate flow, JSA merges the following fields with the original flow record so that you can tell where the duplicate record was observed on the network.
Flow source ID
Flow source name
Source ASN
Destination ASN
Input IF index
Output IF index
Configuring Flow Deduplication
You can configure flow deduplication to take place at either the Flow Processor.
When your Flow Processor receives data from two different flow sources that are monitoring the same part of the network, configure deduplication at the Flow Processor appliance. For example, your Flow Processor might receive data from a 3rd party flow exporter as well as its own network TAP.
When you have two different Flow Processors that monitor overlapping parts of the network, the individual flow processors are unaware of the deduplication. In the scenario, you configure deduplication at the Flow Processor appliance.
You can set the flow deduplication method in the configuration settings for the appliance. For more information, see Configuring a Flow Processor.