Subject: [IPFIX] flowStartSysUpTime and flowEndSysUpTime versus sysUpTime

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 16 Nov 2010 13:35:41 +0100

Hi,

RFC 5102 has the following text:

   5.9.12.  flowStartSysUpTime
   
      Description:
         The relative timestamp of the first packet of this Flow.  It
         indicates the number of milliseconds since the last
         (re-)initialization of the IPFIX Device (sysUpTime).
      Abstract Data Type: unsigned32
      ElementId: 22
      Status: current
      Units: milliseconds
   
   5.9.13.  flowEndSysUpTime
   
      Description:
         The relative timestamp of the last packet of this Flow.  It
         indicates the number of milliseconds since the last
         (re-)initialization of the IPFIX Device (sysUpTime).
      Abstract Data Type: unsigned32
      ElementId: 21
      Status: current
      Units: milliseconds

I assume the "(sysUpTime)" refers to the definition given in RFC 3418:

   sysUpTime OBJECT-TYPE
       SYNTAX      TimeTicks
       MAX-ACCESS  read-only
       STATUS      current
       DESCRIPTION
               "The time (in hundredths of a second) since the
               network management portion of the system was last
               re-initialized."
       ::= { system 3 }

Note that sysUpTime is counted in hundredths of a second and not
milliseconds (means different rollover times) and that sysUpTime is
counted from the last re-initialization of the network management
portion of a system, which is not necessarily the same as the
(re-)initialization of the IPFIX Device.

A possible fix is to remove any references to "(sysUpTime)" from RFC
5101.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Juergen Quittek <[email-masked]>
Date: Thu, 25 Nov 2010 08:06:39 +0000

Hi Juergen,

Thank you for this hint.
An alternative fix would be to align these counters more closely with
sysUpTime.

    Juergen Q.

---

From: Brian Trammell <[email-masked]>
Date: Thu, 25 Nov 2010 15:02:52 +0100

Hi, Juergen and Juergen,

I always read the precision of the system uptime counter as being implementation-dependent (as experience shows it generally is). The units are milliseconds, but the actual precision is up to the device... Issues such as this, as I recall, are part of the reason for the advice on timing precision in RFC 5153. Indeed, not having much of an SNMP background I find the 3418 specification of sysUpTime to be a little odd. 

sysUpTime (the IPFIX definition) follows the NetFlow V9 definition (itself specified in 3954 and canonically defined by Cisco's implementation thereof); changing it, at this point, is not interoperably possible. Therefore, I'd second the initial recommendation  and make it clear (perhaps in an erratum on 5102, and by editorially correcting the IANA registry) that sysUpTime is _not_ 3418 sysUpTime.

Best regards,

Brian

On Nov 25, 2010, at 9:06 AM, Juergen Quittek wrote:

> _______________________________________________
> IPFIX mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipfix

---

From: Benoit Claise <[email-masked]>
Date: Thu, 25 Nov 2010 16:45:31 +0100

Hi,
> sysUpTime (the IPFIX definition) follows the NetFlow V9 definition (itself specified in 3954 and canonically defined by Cisco's implementation thereof); changing it, at this point, is not interoper…
Agreed.

Regards, Benoit.

---

From: Juergen Quittek <[email-masked]>
Date: Fri, 26 Nov 2010 14:57:16 +0000

Dear all,

On 25.11.10 16:45  "Benoit Claise" <[email-masked]> wrote:

> Hi,
>> Hi, Juergen and Juergen,
>> 
>> I always read the precision of the system uptime counter as being
>> implementation-dependent (as experience shows it generally is). The units are
>> milliseconds, but the actual precision is up to the device... Issues such as
>> this, as I recall, are part of the reason for the advice on timing precision
>> in RFC 5153. Indeed, not having much of an SNMP background I find the 3418
>> specification of sysUpTime to be a little odd.
>> 
>> sysUpTime (the IPFIX definition) follows the NetFlow V9 definition (itself
>> specified in 3954 and canonically defined by Cisco's implementation thereof);
>> changing it, at this point, is not interoperably possible. Therefore, I'd
>> second the initial recommendation  and make it clear (perhaps in an erratum
>> on 5102, and by editorially correcting the IANA registry) that sysUpTime is
>> _not_ 3418 sysUpTime.
> Agreed.

Fine. Let's file an erratum.

    Juergen