> To my knowledge, the IPFIX tags list also include netflow v9 tags regardless > whether they are used or not and whether > they make sense or not. So you will find any v9 tags in the IPFIX table also > 21,22. They are used in v9. The sysupTime > itself is transferred in the v9 header. So the collector can calculate the > absolute time stamps. However, this sysupTime > does not exists in IPFIX, neither as tag nor in the header. IPFIX and and > netflow v9 have different headers. The > collector is therefore unable to display start/stop time stamps. Instead of > relative time stamps 21,22 your device > should use absolute time stamps 152,153 which are common in IPFIX.
I finally have a proposed solution to this issue from Extreme - though I'm not too sure on it's efficacy. To recap briefly, in their IPFIX implementation Extreme is exporting tags 21,22 (relative timestamps to sysUpTime) but they are not transmitting the tags necessary to calculate sysUpTime so that's rendering the relative tags useless since there's no time to be relative to. I had requested that they add tags 152,153 to address this. Their proposed solution is to instead add tag 160 (systemInitTimeMilliseconds). That way the data in tags 21,22 can be used with tag 160 to calculate the flow times. I find it odd that they want to mix an IPFIX specific tag with the netflow tags, but it may satisfy that part of the RFC requirement nonetheless. Will this proposed solution work? Thanks. - Mike ------------------------------------------------------------------------------ Managing the Performance of Cloud-Based Applications Take advantage of what the Cloud has to offer - Avoid Common Pitfalls. Read the Whitepaper. http://pubads.g.doubleclick.net/gampad/clk?id=121051231&iu=/4140/ostg.clktrk _______________________________________________ Nfdump-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
