On 3/2/14 10:40 PM, Mike Sherman wrote:
>> To my knowledge, the IPFIX tags list also include netflow v9 tags regardless
>> whether they are used or not and whether
>> they make sense or not. So you will find any v9 tags in the IPFIX table also
>> 21,22. They are used in v9. The sysupTime
>> itself is transferred in the v9 header. So the collector can calculate the
>> absolute time stamps. However, this sysupTime
>> does not exists in IPFIX, neither as tag nor in the header. IPFIX and and
>> netflow v9 have different headers. The
>> collector is therefore unable to display start/stop time stamps. Instead of
>> relative time stamps 21,22 your device
>> should use absolute time stamps 152,153 which are common in IPFIX.
>
>
> I finally have a proposed solution to this issue from Extreme - though
> I'm not too sure on it's efficacy. To recap briefly, in their IPFIX
> implementation Extreme is exporting tags 21,22 (relative timestamps to
> sysUpTime) but they are not transmitting the tags necessary to calculate
> sysUpTime so that's rendering the relative tags useless since there's no
> time to be relative to.
>
> I had requested that they add tags 152,153 to address this. Their
> proposed solution is to instead add tag 160
> (systemInitTimeMilliseconds). That way the data in tags 21,22 can be
> used with tag 160 to calculate the flow times.
Well - relative is always a hassle to deal with the overflows etc, but it's
better than having no time stamps :)
However, the better solution would be the tags 152,153. It does not really make
a difference for them.
If you have any pcaps feed them to me off list, so I can implement that.
Thanks
- Peter
>
> I find it odd that they want to mix an IPFIX specific tag with the
> netflow tags, but it may satisfy that part of the RFC requirement
> nonetheless. Will this proposed solution work?
>
> Thanks.
>
> - Mike
>
> ------------------------------------------------------------------------------
> Managing the Performance of Cloud-Based Applications
> Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
> Read the Whitepaper.
> http://pubads.g.doubleclick.net/gampad/clk?id=121051231&iu=/4140/ostg.clktrk
> _______________________________________________
> Nfdump-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
>
--
Be nice to your netflow data. Use NfSen and nfdump :)
------------------------------------------------------------------------------
Managing the Performance of Cloud-Based Applications
Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
Read the Whitepaper.
http://pubads.g.doubleclick.net/gampad/clk?id=121051231&iu=/4140/ostg.clktrk
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
