Hello, We have just noticed that pflow (v5) sometime (but often) uses a StartTime value which is later than the EndTime. So the duration is interpreted 4294966.296000000 secondes. This confuses our collector (nfsen).
(wireshark) pdu 19/30 SrcAddr: 194.57.169.116 (194.57.169.116) DstAddr: 129.20.254.1 (129.20.254.1) NextHop: 0.0.0.0 (0.0.0.0) InputInt: 0 OutputInt: 0 Packets: 3 Octets: 164 [Duration: 4294966.296000000 seconds] StartTime: 251367.000000000 seconds EndTime: 251366.000000000 seconds SrcPort: 55680 DstPort: 53 padding TCP Flags: 0x00 Protocol: 6 IP ToS: 0x00 SrcAS: 0 DstAS: 0 SrcMask: 0 (prefix: 194.57.169.116/32) DstMask: 0 (prefix: 129.20.254.1/32) padding Any clue? Thanks, regards.