Re: [IPFIX] Export of long lived flow information

[Paul Aitken <[e-mail]>]

Brian,

> In your case, if you've _already got_ a persistent cache for other 
> reasons, then by all means use it. :) In that case you just need an 
> extra timestamp, to keep track of the time of the first packet 
> observed after the last export, in addition to the first "real" 
> packet, if you want to export "complete" (delta) flows.

A collector can obtain delta counts from a series of total counts.

It may be a little inaccurate if observations were not evenly 
distributed throughout the interval between total count reports. However 
this may not matter if the collector is simply reporting aggregates or 
averages within an interval.

eg, if the collector produces hourly reports, it can simply calculate 
the delta between the current packetTotalCount and the packetTotalCount 
an hour ago, without being concerned whether the packets arrived at the 
beginning of the hour, throughout the hour, or at the end of the hour.

P.