Subject: Re: [IPFIX] IPFIX flows timestamps

From: Benoit Claise <[email-masked]>
Date: Tue, 23 Nov 2010 13:43:05 +0100

Hi Thierry,
> Hello,
>
> I am currently developing a collector NetFlow / IPFIX.I am trying to 
> decode the "first switched" and "last switched" timestamps of flows 
> with an accuracy of one second. It was simple so far with Netflows. 
> With IPFIX, is there a simple and standard way to do that ? (Or should 
> I deal with all possible combinations of time fields 
> (flowStartSysUpTime, flowEndSysUpTime, systemInitTimeMilliseconds, 
> flowStartMicroseconds, flowEndMicroseconds, 
> flowStartDeltaMicroseconds, flowEndDeltaMicroseconds...) ?
You should have a generic solution.

Regards, Benoit.
>
> What are the manufacturers and models of router implementing IPFIX? 
> What type of timestamp do they implement?
>
> Thanks a lot in advance.
> Regards
>
> Thierry Descombes
> LPSC - CNRS
>
>
> _______________________________________________
> IPFIX mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipfix

---

From: DESCOMBES Thierry <[email-masked]>
Date: Fri, 26 Nov 2010 11:12:19 +0100

Hi Benoit,
Thanks for your answer.
> You should have a generic solution.
Yes, sure... But I must be certain that my generic algorithm can deal 
with most cases...
So, what is the current template data definition of Cisco switchs 
(mainly concerning the timestamp) ? Is it possible to configure them 
with all combinaisons of datatimestamps ? (With the 6000 series and 
NetFlow 9... Template data seems fixed and not configurable). With 
IPfix, are Cisco switches still using  "LAST_SWITCHED" and 
"FIRST_SWITCHED" fields ? If yes... why have you decided to remove the 
"sysuptime" field, and how should I guess the sysuptime to deal with 
this timestamps ?
Thanks a lot.
Cheers
T.D

---

From: Gerhard Muenz <[email-masked]>
Date: Sat, 27 Nov 2010 13:06:49 +0100

Hi Thierry,

> Yes, sure... But I must be certain that my generic algorithm can deal

If current Cisco products export one type of time stamp, the next router 
generation or routers from another vendor might still export another type.

So, if you want a generic algorithm, you need to be able to process all 
kinds of time stamps. Converting them to a common internal format of 
your choice (e.g. unix time measured in milliseconds) is not a big deal.

Regards,
Gerhard

---

From: descombes <[email-masked]>
Date: Sun, 28 Nov 2010 17:40:26 +0100

Hi Gerhard,

> generation or routers from another vendor might still export another
type.

Yes, you're right... anyway, my aim is not to write a wonderful generic
algorithm, which can deal with all combinaison of timestamp fields, that
I'll never get, since... no current Ipfix implementation is able to send
them ! If Cisco implementation just send "LAST_SWITCHED" and
"FIRST_SWITCHED" fields... I can't guess the sysuptime, and it's not worth
I bother me: whatever algorithm I do, my software will just work with
NetFlow 9.

So, what's the situation ?
Cheers,

T.D

---

From: Paul Aitken <[email-masked]>
Date: Tue, 30 Nov 2010 11:18:00 +0000

Thierry,

> If Cisco implementation just send "LAST_SWITCHED" and
> "FIRST_SWITCHED" fields... I can't guess the sysuptime, and it's not
> worth I bother me: whatever algorithm I do, my software will just
> work with NetFlow 9.
>

Although this isn't the place to discuss details of cisco's
implementation, please be assured that we won't export sysuptime based
timestamps that you can't possibly decode.

Depending upon the implementation, we would either select an appropriate
pair of timestamps from the #150 - #159 range to export instead of the
sysuptime, or export sysuptime fields and also include #160
systemInitTimeMilliseconds which gives the base time.

See section 4.7 of RFC 5153:

    Therefore, the sending of the flowStartSysUpTime and flowEndSysUpTime
    Information Elements without also sending the
    systemInitTimeMilliseconds Information Element is not recommended.

Cheers,
P.

---

From: DESCOMBES Thierry <[email-masked]>
Date: Tue, 30 Nov 2010 17:00:02 +0100

Hi Paul,
Thanks for your answer. You're right and I don't want to discuss details 
of Cisco's implementation. I'd just like to know if a compatible network 
equipement exists, in order to test my algorithm. Until now, is there 
any implementations of IPFix on switches ? I've read that Nortel finally 
used Netflow 9... Thanks a lot.
Cheers
T.D