There are couple of reasons that you are seeing Null0:
Null0 generally represents traffic that is multicast or broadcast. Also, it can be the traffic that is ending in that device or device doesn’t provide egress information. There is information from a webpage written by one of our customers.
Here are the excerpts from that page:
First of all, Catalyst 3850 is a hardware platform, it has to perform NetFlow collection and reporting without affecting the performance of its main task packets/frames forwarding. Hence, hardware platform limitations cannot be avoided. This switches Flexible NetFlow does not have access to as many amount of fields/keys as on any ISR platform. The most essential limitation relates to the availability of information about ingress and egress interfaces. Catalyst 3850 is unable to provide egress interface information for flows captured in ingress/input direction.
Likewise, it does not provide ingress interface information for flows captured in egress/output direction, such as shown on the following screenshot. For this reason, it is not possible to use single flow monitor for both directions! There must be at least two FNF monitors configured, each referring to its own FNF record. Output record will use output interface as its key/match criteria and Inputrecord will use input interface as its key/match criteria. Even though it is possible to configure FNF record to collect non-key information about ingress/egress interfaces, it will always be set to Null0.
This limitation can be critical for NetFlow collecting systems that try to visualize flows information, such as LiveAction.