search

CESNET / ipfixcol2

High-performance NetFlow v5/v9 and IPFIX collector (RFC7011)
Other
123 stars 36 forks source link

IPFIX elements #24

Open ancobosd opened 4 years ago

ancobosd commented 4 years ago

Hi Lukas,

I open this issue due to when I get IPFIX packets I can not see the whole elements defined at IANA. I have checked that ipfix-elements.xml at ipfixcol are all setted and at this new version seems to be setted by default too. I am trying to make a flow evaluator and take decisions based on data analized, but I can not achieve this if I can not see the fields I need. Maybe could be an implementation error? (I have got the same result for both collector, version 1 and 2). Why (for example) flowStartMicroseconds doesn't appear at IPFIX packet? It could be useful to calculate the bandwidth based on octetDeltaCount field.

Could you help me, please?

Thanks a lot.

BR

Lukas955 commented 4 years ago

Hi,

elements present in IPFIX packets always depend on abilities of your exporter/probe. In other words, if your exporter/probe is not producing them, the collector cannot do anything about it. However, you can try to check the configuration of the exporter to see if it is possible to extend flow records.

Nevertheless, if 'flowStartMicroseconds' is not in your flow records, some alternatives are usually there, for example, 'flowStartMilliseconds'.

Lukas

ancobosd commented 4 years ago

My exporter is a ovs bridge. Maybe you know about some correct configuration for that

thorgrin commented 4 years ago

As a side note, I'll mention that ovs is not the greatest of exporters. I've analysed its output in the past and it was nearly absolute bul***t. Just a quick search for some up-to-date reference gives me this thread: https://www.reddit.com/r/networking/comments/bwcs3e/ipfix_on_ovs_switches_issues_ive_encountered/

I'd recommend to stay away from the ovs IPFIX, create a span port and use something else.