Hi Mike,
Your Device uses netflow v9 convention ( tags 21,22 ) in order to specify
timestamps. These timestamps are msec offsecs
since device boot time. This methode is, to my knowledge no standard in IPFIX,
as IPFIX does not announce the sysuptime,
neither as tag nor in the header, as netflow v9 does. Therefore you need to
contact your device manufacture to change
that into IPFIX tags ( 152, 153 ). Therefore I can't help.
Regards
- Peter
On 9/21/13 W38 16:40, Mike Sherman wrote:
> On 9/21/13 2:59 AM, Phil Mayers wrote:
>> What usually helps in these cases is a packet capture of the IPFIX
>> stream; be sure to get a template as well as the matching data packets.
>> Wireshark can be extremely helpful in these cases.
>>
>> What kind of Extreme device and XOS version? I could try on the bench
>> locally.
>
>
> I'm using a Summit x480 running XOS 15.3.2.11. I set up a 1000 packet
> capture and then started the IPFIX collection.
> The pcap file is attached; I'm assuming that caught the template since the
> first packet appears larger than the rest.
>
> Cheers.
>
> - Mike
>
>
> ------------------------------------------------------------------------------
> LIMITED TIME SALE - Full Year of Microsoft Training For Just $49.99!
> 1,500+ hours of tutorials including VisualStudio 2012, Windows 8, SharePoint
> 2013, SQL 2012, MVC 4, more. BEST VALUE: New Multi-Library Power Pack includes
> Mobile, Cloud, Java, and UX Design. Lowest price ever! Ends 9/22/13.
> http://pubads.g.doubleclick.net/gampad/clk?id=64545871&iu=/4140/ostg.clktrk
>
>
>
> _______________________________________________
> Nfdump-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
>
--
--
Be nice to your netflow data
------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
