search

cloudflare / goflow

The high-scalability sFlow/NetFlow/IPFIX collector used internally at Cloudflare.
BSD 3-Clause "New" or "Revised" License
859 stars 173 forks source link

Add FlowTimeStart and FlowTimeEnd #25

Closed debugloop closed 5 years ago

debugloop commented 5 years ago

Solves #22

As discussed in the issue, this adds both time fields and marks the TimeFlow field for eventual deprecation. The mentioned processing speed limitations do not appear to be a problem, see the following screenshot of the 99th percentile of goflow speed metrics from my monitoring.

99th percentile of goflow speed metrics

I've tested NFv9 and am confident that IPFIX will work too, but I am unsure about the sFlow implementation. The latest two commits shave some bytes of a single flow message, but I am unsure about it, as TimeRecvd is the same anyways. It might be best to populate all three fields with the same value, or to leave both TimeFlow* empty.

lspgn commented 5 years ago

Looks good! Will give it a try and hopefully will merge :) . Thank you!