timestamps on IPFIX from IOS-XR 6.0 are not working about nfdump HOT 5 CLOSED

Thx. I fix it.

from nfdump.

Hi @phaag - Do you mean you have fixed it, or are you going to fix it ?

from nfdump.

After looking into the pcap, I can tell, that this is not an nfcapd issue, but a CISCO issue.

What is it all about:
The data exported is IPFIX. IPFIX has a lot of elements. I can refer to the IANA site http://www.iana.org/assignments/ipfix/ipfix.xhtml

Many of these elements are identical to netflow v9, but it has a lot of additions.
Many IPFIX exporters export the timestamps with the elements 152, 153:

152 flowStartMilliseconds
dateTimeMilliseconds The absolute timestamp of the first packet of this Flow. milliseconds
153 flowEndMilliseconds
dateTimeMilliseconds The absolute timestamp of the last packet of this Flow. milliseconds

In your stream of the IOS-XR 6.0, the start and end timestamps are announced with the elements 21, 22. 21 and 22 are the default elements in many v9 exporters. The difference to 152, 153 is, that 21,22 are relative time stamps - relative to the boot time of the device. In v9 the boot time is announced by the exporter in the header of a data record for all flows in that record. IPFIX has different header data structures and no sysup time in the header.

The IPFIX RFC says:
21 flowEndSysUpTime unsigned32
The relative timestamp of the last packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). sysUpTime can be calculated from systemInitTimeMilliseconds.

22 flowStartSysUpTime unsigned32
The relative timestamp of the first packet of this Flow. It indicates the number of milliseconds since the last (re-)initialization of the IPFIX Device (sysUpTime). sysUpTime can be calculated from systemInitTimeMilliseconds.

For both elements: sysUpTime can be calculated from systemInitTimeMilliseconds
systemInitTimeMilliseconds is element 160:

160 systemInitTimeMilliseconds dateTimeMilliseconds
The absolute timestamp of the last (re-)initialization of the IPFIX Device.

However, none of the templates in your pcap contains the element 160. Therefore, it is not possible to calculate the timestamps for start and end of the flow.

In order to fix that, CISCO needs to fix their templates to add either element 160, or switch to elements 152, 153 which is most common for many IPFIX exporters.
Up to now, nfcapd does not decode element 160, so if CISCO decides to go that way, please let me know, then I can add that. If they switch to 152, 153 it works out of the box.

from nfdump.

Thank you, that is very valuable information that I'll send along to Cisco.

from nfdump.

Not an nfdump issue.

from nfdump.