Subject: [ipfix] Fwd: NetFlow v.x timestamp rollover

From: Mark Fullmer <[email-masked]>
Date: Sun, 11 Jan 2004 20:40:10 -0500

<resending with a valid source address>

Begin forwarded message:

> From: Mark Fullmer <[email-masked]>
> Date: January 11, 2004 7:59:51 PM EST
> To: 'Ipfix Wg' (E-mail) <[email-masked]>
> Cc: Benoit Claise <[email-masked]>
> Subject: NetFlow v.x timestamp rollover
>
> Benoit asked for a clarification on the NetFlow vx timestamp rollover
> circumstance.
>
> Start and End time represent the router uptime in milliseconds.  This
> will rollover at 3^32-1 milliseconds or about every 49 days.  If a flow
> is created near this border the Start time will be greater then the
> End time.  For example
>
> Time  Event
> -------------------
> T1    router uptime is 4294967290 ms.
> T2    flow is created at sysUpTime of 4294967290.
> T3    flow is ended at sysUpTime of 4294967296 ms.
> T4    flow is expired at sysUpTime of 4294967297 ms.
>
> 4294967296 doesn't fit in 32 bits so the End time will be 0 due to
> rollover.  The header sysUptime will then be 1.
>
> If an application is using the header {sysUpTime,unix_secs,unix_nsecs) 
> to
> convert the flow {End,Start} time to real time it needs to be careful
> to take this rollover into consideration.
>
> Ditto for calculating flow durations.
>
> This situation does not happen in what we've been calling "split-time".
>
> --
> mark
>

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: "Carter Bullard" <[email-masked]>
Date: Mon, 12 Jan 2004 10:30:06 -0500

This situation also doesn't happen when real time is
provided in the flow records to begin with.  Providing
relative time only generates limitations for the protocol,
since it forces "scope" on what should be a streaming
protocol.  At present IPFIX can only be a block protocol.

Carter

-----Original Message-----
From: majordomo listserver [mailto:[email-masked]] On Behalf Of
Mark Fullmer
Sent: Sunday, January 11, 2004 8:40 PM
To: 'Ipfix Wg' (E-mail)
Subject: [ipfix] Fwd: NetFlow v.x timestamp rollover

--
Help        mailto:[email-masked] and say "help" in message
body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Mark Fullmer <[email-masked]>
Date: Mon, 12 Jan 2004 11:15:22 -0500

IPFIX will support at least the 64 bit NTP format absolute Start and End
timestamps.  The split-time IE will be available as an optimization
to reduce bandwidth.  Collectors will obviously need to support both.

mark