Re: [IPFIX] Export of long lived flow information

Hi,

flowStartTime is the time of the first packet you are reporting on in 
the given record. So, including totalCount fields implicitly means that 
flowStartTime is the time of the very first packet ever observed for 
this flow.

Now, you can continue discussing what happens if both totalCounts and 
deltaCounts are included in the same record :)

Regards,
Gerhard


On 24.10.2012 22:28, John Court wrote:
> Just to be crystal clear on this point of persistent caches.  Even when
> sending "totalCount" fields, the flowStartTime is still relative to the
> current flow record, it doesn't represent the "original" first packet
> ever seen for the flow key in the cache ?  I just want to make sure of
> the semantics of flowStartTime in all cases.
>
> Thanks again for the comments and clarifications
>
> John Court
> Software Engineer
> IBM Security Systems Division
> IBM Australia Development Laboratory
> Office:  +61 7 5552 4014
> Mobile: +61 430 841328
>
>
>
>
>
> From: Paul Aitken <[email protected]>
> To: John Court/Australia/IBM@IBMAU,
> Cc: Brian Trammell <[email protected]>, [email protected]
> Date: 24/10/2012 19:49
> Subject: Re: [IPFIX] Export of long lived flow information
> ------------------------------------------------------------------------
>
>
>
> John,
>
> I suspect I have been mis-interpreting your concept of "persistent caches".
>
> In a normal cache, the entries are eventually removed - because they've
> ended, or they've not seen traffic for an amount of time, or they're
> just too old, or there's simply not enough room in the cache.
>
> Whereas in a permanent cache, the entries are never removed.
>
> P.
>
>
> _______________________________________________
> IPFIX mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/ipfix
>
_______________________________________________
IPFIX mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipfix