Is it best practice to enable netflow on internal or external interfaces.
Also, which direction?
We have a few remote sites connecting back to us via MPLS. I am monitoring their serial interfaces (in the ingress direction). Is this sufficient to analyze bandwidth utilization? Or should I montior egress too?