The Null0 "interface" is a virtual bit-bucket. Meaning it's a trash can to route things to. There's automatically a Null0 route (called a Discard Route) created when you do a summary-address or area-range or things like that with routing protocols.
The idea behind this is that you are creating a summary address manually to tell other routers about. If you are therefore expecting to receive packets for anything within that summary range, what will your router do about it? if it has more specific routes, packets will get routed perfectly fine.
Anything not matching more specific routes would get sent to the discard route and therefore destroyed in a flash of Null0 mayhem. Without the discard route, your router would be either trying to look things up or possibly sending to a default route (0.0.0.0/0) it has in its table. This in turn, may cause a routing loop where the router with the 0/0 route contains the summary you manually advertised and so packets bounce needlessly until the TTL expires!
It's a protection mechanism.
You may also use Null0 as a destination in static routes if you would like particular packets to die a horrible death as well!
Thanks mate but one more question what if one of the route from the the summary address goes down for whatever reason. Then the packets destined for that particular route will they be routed to Null0 interface?
Also please I would appreciate if you can provide me a link to get the details of Null0 interface.
As long as one "candidate route" (route within the summary) exists, the summary will still be advertised. As for packets destined for a route that went down, well, they'd go to Null0 as that summary would likely be the "next best" path to the original destination that's no longer there.
I'm having Cisco ASA 5540 , i want to monitor traffic of that ASA using netflowi'm using Solarwinds Netflow Analyzer, when i configure ASA, software is detecting all interfaces of ASA, but Solawinds showing that all traffic is going through Null 0 interface
what is the reason for this ?
how can i monor traffic by interface level?
Your reply was helpful for me even i read this answer on 25th May 2014. I was trying to raise same question on discussion board but i got this discussion on google.