NetFlow V5 records have strange data in ip address fields. There is ip address of local PPPoE interface (PPP Profile Local address) instead of real source ip address of Internet hosts for incoming traffic. For outgoing traffic the situation is same but local ip address of PPPoE interface is moved to Destination ip field. Before RouterOS version 6.29/6.29.1 all above has been working correctly. In our humble opinion those situation may be correlated with 6.29 release note: trafflow: add natted addrs/ports to ipv4 flow info…
Incoming packet from http://www.yandex.ru:
Before RouterOS version 6.29/6.29.1
Source ip Destination ip Input_interface NAS ip (Mikrotik external interface)
93.158.134.3 10.128.17.117 0 80.67.250.102
For RouterOS version 6.29/6.29.1
Source ip Destination ip Input_interface NAS ip (Mikrotik external interface)
192.168.100.1 10.128.17.117 0 80.67.250.102