Re: [pmacct-discussion] Questions about IPFIX and pmacct

2014-06-03 Thread Thomas King
Hi Paolo, thank you very much for your prompt reply. My comments are also inline. On 28 May 2014, at 17:39, Paolo Lucente pa...@pmacct.net wrote: On Wed, May 28, 2014 at 07:47:45AM +, Thomas King wrote: - From the documentation I reasoned that pmacct/nfacct is able to handle IPFIX

Re: [pmacct-discussion] Questions about IPFIX and pmacct

2014-06-03 Thread Thomas King
Hi Pierre-Yves, thanks for your suggestions. On 28 May 2014, at 18:24, Pierre-Yves Maunier pymaunier+li...@gmail.com wrote: 2014-05-28 9:47 GMT+02:00 Thomas King thomas.k...@de-cix.net: - From the documentation I reasoned that pmacct/nfacct is able to handle IPFIX sampling. I use IPFIX

Re: [pmacct-discussion] Questions about IPFIX and pmacct

2014-06-03 Thread Paolo Lucente
Hi Thomas, Comments in-line: On Tue, Jun 03, 2014 at 02:48:33PM +, Thomas King wrote: We double checked the IPFIX data coming from our router. The sampling rate is contained in the data. It comes via a data record (template id=256) and the relevant fields are named

Re: [pmacct-discussion] Timestamps in RabbitMQ/JSON output

2014-06-03 Thread Chris Wilson
Hi Paolo, On Tue, 3 Jun 2014, Paolo Lucente wrote: What you describe for timestamps seems a good match for NetFlow, ie. cast packets into flows and handle these via a flow-aware cache (so active/passive expiration timers, max lifetime, etc.). All described is already part of the nfprobe