Subject: Re: [IPFIX] Export of long lived flow information

From: John Court <[email-masked]>
Date: Wed, 24 Oct 2012 08:10:03 +1000

Sorry one last bit is still niggling me.

I would think that if a flow was being reported because the Meter or 
Exporter wanted to reclaim resources, it would use the flowEndReason of 
"lack of resources 0x05".  This gives a clear indication that the flow is 
no longer being tracked and that any future record for that connection 
will be with a new flowStartTime.  I think that is why I considered it 
reasonable to maintain the original flowStartTime with the "active timeout 
0x02"  flowEndReason.

Of course reading it now I understand what was in the mind of the authors. 
 If the field had been "flowReportReason" rather than "flowEndReason" 
perhaps it could have dealt with the concepts updates more easily :-)

Thanks again.

John Court
Software Engineer
IBM Security Systems Division
IBM Australia Development Laboratory
Office:  +61 7 5552 4014
Mobile: +61 430 841328