[IPFIX] Export of long lived flow information

[John Court <[e-mail]>]

Hi,

I have been a subscriber to the list for a little over a year, and an 
implementer of IPFIX export for at least one product.  This WG has done 
great work overall !

One area that still has me a little confused even after researching as 
many of the RFCs as possible including RFC5472 is how to treat export of 
long lived flows.

At the moment I use "DeltaCount" information elements for everything and 
at specific intervals export long lived flows with the flowEndReason of 
"flowActiveTimeout".  This of course results in multiple flow records for 
long lived connections over time.  Since this situation doesn't seem to be 
covered explicitly I was hoping someone on the list would point me in the 
right direction or confirm my assumptions.  On thing that is particularly 
unclear is what to do about flowStart/flowEnd times when sending this type 
of record.

Thanks

John Court
Senior Software Engineer
IBM Security Systems Division
IBM Australia Development Laboratory
Office:  [phone]
Mobile: [phone]