Hi all,
a question for those using Juniper routers. J-flow seems to have a bug
associated with the Active Timeout (so, it will be evident for long-lasting
flows only) when using Multi Service Pics (dedicated interface cards to offload
the NetFlow generation from the central Router Processor).
This behaviour is documented in a recently published paper:
http://pam2009.kaist.ac.kr/paper/54480187.pdf
See figure 3 and relative explanation on "Active Timeout".
Basically, flows will be exported but not removed from the cache: all counters
are thus reset, except for the one containing the flow start time. As a
consequence, if there is a long lasting flows, flow updates will arrive at the
collector regularly (every Active Timeout seconds), the flow will contain the
number of packets and the number of bytes since the last update but the start
time will be fixed at the time of flow creation!
I just bumped into this problem and I wonder how NfSen will treat these flows
arriving regularly, with the same 5-tuple, but with a start time that is fixed
in the past.
Thanks,
Maurizio
--
______________________________________________________________________
Maurizio Molina
Network Engineer
DANTE - www.dante.net<http://www.dante.net/>
Tel: +44 (0)1223 371 300
Fax: +44 (0)1223 371 371
Email: [email protected]<mailto:[email protected]>
PGP Key ID: 3FF58D51
City House, 126-130 Hills Road
Cambridge CB2 1PQ
UK
_____________________________________________________________________
------------------------------------------------------------------------------
Enter the BlackBerry Developer Challenge
This is your chance to win up to $100,000 in prizes! For a limited time,
vendors submitting new applications to BlackBerry App World(TM) will have
the opportunity to enter the BlackBerry Developer Challenge. See full prize
details at: http://p.sf.net/sfu/Challenge
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
