Re: [IPFIX] Export of long lived flow information

[Paul Aitken <[e-mail]>]

John,

> Paul,
>
> *Definitely. If it's a permanent flow and you're exporting totalCount
> fields - which are measured "since the Metering Process
> (re-)initialization for this Observation Point" - then the flowStartTime
> must surely be the time the first ever packet was observed.*
>
> If you take that literally shouldn't that be interpreted to mean that 
> the totalCount continues into the next time a connection is up between 
> the same flow key ?

Yes, that's what it says.


> Even if a flowEndReason of :
>
>  0x03: end of Flow detected
> The Flow was terminated because the Metering Process
> detected signals indicating the end of the Flow, for
> example, the TCP FIN flag.

The definitions of *totalCount are independent of flowEndReason.


> That clearly wouldn't be of much use IMO and makes it difficult to see 
> what the flowEndReason field semantics mean in that context.  Just 
> pointing out that taking that definition literally doesn't give a 
> useful answer on its own either :-).  Although maybe that does make 
> sense in a router context ?  Can you clarify this some more, perhaps 
> you never intend using the flowEndReason IE in your case ?

We do use flowEndReason. However, flowEndReason doesn't logically apply 
to permanent flows: they're permanent, therefore, they don't end.

P.