search

netsampler / goflow2

High performance sFlow/IPFIX/NetFlow Collector
BSD 3-Clause "New" or "Revised" License
466 stars 110 forks source link

FIRST_SWITCHED and LAST_SWITCH not corresponding RFC or CISCO #78

Closed ghost closed 2 years ago

ghost commented 2 years ago

RFC 3954 and NetFlow Version 9 Flow-Record Format both specify the fields FIRST_SWITCHED and LAST_SWITCHED as System uptime in milliseconds, however, goflow2 produces them in seconds: https://github.com/netsampler/goflow2/blob/58f0f97a629cf0cc1d1786c06a27ac2d107717bc/producer/producer_nf.go#L337-L350

Is this an error, or are both fields produced in seconds for a reason I am unaware of?

lspgn commented 2 years ago

Hello, Thank you for your contribution. TimeFlowStart and TimeFlowEnd are in seconds. The reason was at the time it was written, millisecond accuracy was not needed and was inserted nicely in Clickhouse as a DateTime.

I cannot change the unit now as it would break many current implementations. Furthermore, you are only updating NetFlow v9 and not NetFlow v5 and sFlow.

I hope you understand I cannot merge your PR. My suggestion would be to introduce TimeFlowStartMs and TimeFlowEndMs if this new feature receives positive feedbacks.

ghost commented 2 years ago

My suggestion would be to introduce TimeFlowStartMs and TimeFlowEndMs if this new feature receives positive feedbacks.

Hello @lspgn, As other issues has been created (#80) with interest in obtaining the fields TimeFlowStart and TimeFlowEnd in milliseconds for different versions of Netflow. Considering your suggestion I have added the fields TimeFlowStartMs and TimeFlowEndMs for the versions of Netflow supported by goflow2 (v5, v9 and v10), changes are in the Pull Request #81.