Hi Mike, snip ..
> > Just so I can wrap my head around this just a bit before attempting to open a > case with Extreme -- looking at the > definitions for the IPFIX tags: > > https://www.iana.org/assignments/ipfix/ipfix.xhtml > > The definition of the four tags: > > 21: The relative timestamp of the last packet of this Flow. It indicates the > number of milliseconds since the last > (re-)initialization of the IPFIX Device (sysUpTime). > > 22: The relative timestamp of the first packet of this Flow. It indicates the > number of milliseconds since the last > (re-)initialization of the IPFIX Device (sysUpTime). > > 152: The absolute timestamp of the first packet of this Flow. > > 153: The absolute timestamp of the last packet of this Flow. > > > > I think I'm missing something (forgive my ignorance). Your description of > what the device is exporting into tags 21/22 > (offset in msec since boot) seems to match what's listed on the tag page. To my knowledge, the IPFIX tags list also include netflow v9 tags regardless whether they are used or not and whether they make sense or not. So you will find any v9 tags in the IPFIX table also 21,22. They are used in v9. The sysupTime itself is transferred in the v9 header. So the collector can calculate the absolute time stamps. However, this sysupTime does not exists in IPFIX, neither as tag nor in the header. IPFIX and and netflow v9 have different headers. The collector is therefore unable to display start/stop time stamps. Instead of relative time stamps 21,22 your device should use absolute time stamps 152,153 which are common in IPFIX. Hope, that helps. - Peter > > Are you saying that the Extreme is currently exporting data meant for tags > 153/152 into tags 21/22 by mistake? Or is > the data in tags 21/22 correct but they need to also export tags 152/153 and > they are not doing that? > > I just need to be able to clearly describe the issue and what needs to be > done to fix it to them at the time I open the > ticket. > > Thanks. > > - Mike -- -- Be nice to your netflow data ------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk _______________________________________________ Nfdump-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
