Re: [IPFIX] Export of long lived flow information

Just to be crystal clear on this point of persistent caches.  Even when 
sending "totalCount" fields, the flowStartTime is still relative to the 
current flow record, it doesn't represent the "original" first packet ever 
seen for the flow key in the cache ?  I just want to make sure of the 
semantics of flowStartTime in all cases.

Thanks again for the comments and clarifications
 
John Court
Software Engineer
IBM Security Systems Division
IBM Australia Development Laboratory
Office:  +61 7 5552 4014
Mobile: +61 430 841328





From:   Paul Aitken <[email protected]>
To:     John Court/Australia/IBM@IBMAU, 
Cc:     Brian Trammell <[email protected]>, [email protected]
Date:   24/10/2012 19:49
Subject:        Re: [IPFIX] Export of long lived flow information



John,

I suspect I have been mis-interpreting your concept of "persistent 
caches".

In a normal cache, the entries are eventually removed - because they've 
ended, or they've not seen traffic for an amount of time, or they're just 
too old, or there's simply not enough room in the cache.

Whereas in a permanent cache, the entries are never removed.

P.

_______________________________________________
IPFIX mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipfix