[j-nsp] jflow v9 - flow start timestamp not reset

[Sebastian Wiesinger]

* Andrew Jones <aj at jonesy.com.au> [2012-08-12 05:32]:
> Hi All,
> There is a behaviour in jflow v9 which is frustrating me whereby once
> flows reach the active timeout the flow is exported, the packet and byte
> counters reset, but the flow remains in the flow table and the start time
> is not modified. According to Juniper's docs [1], this is to make it easier
> to identify long-lived flows.
> 
> This is annoying when looking at a short period of flow data (eg. 5 mins)
> with tools such as nfdump, because the caculated bps and pps values are way
> too low if the flow started before the beginning of the period you are
> looking at.

Hi,

I have the same problem on the MX platform with IPFIX
("inline-jflow"). On the collector flows are put into files aggregated
every hour. When a flow arrives which is running for three days (seen
today) the collector updates the file from three days ago which was
already analysed and archived.

IMHO the only setting to make this problem a bit less noticable is to
lower flow-inactive-timeout. This will not make the problem go away
but there will be less flows affected by it (depending on traffic
patterns).

Still I would like a knob to change the behaviour.

Regards

Sebastian

-- 
GPG Key: 0x93A0B9CE (F4F6 B1A3 866B 26E9 450A  9D82 58A2 D94A 93A0 B9CE)
'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE.
            -- Terry Pratchett, The Fifth Elephant