Re: [IPFIX] Export of long lived flow information

[John Court <[e-mail]>]

Thanks for the interest in resolving this,

Andrew, I understand your persistent cache argument.  The reason I don't 
personally use "Total" and DO use "Delta"  is more around what the 
collector does should it not see some of the updates and suddenly gets one 
that shows large counter values.  This could mistakenly result in showing 
huge traffic over a short period incorrectly.  This is particularly true 
if you do as Brian suggested and are setting the flowStartTime based only 
on the current record view.

Brian, thanks for your detailed explanation.  Everything with the 
exception of flowStartTime was as I am currently doing.  I had perhaps 
mistakenly taken the approach that keeping the flowStartTime as the 
"conceptual" start rather than for this reporting period would make it 
easier for the collector to understand what was happening.  Not actually 
sure how I will co-ordinate reseting that time on export yet :-)

I would suggest that this sort of situation and Brians explanation be 
added as an example perhaps in 5101 or even 5472 as it would help with 
Collector interoperability I am sure :-)

Thanks again.


John Court
Software Engineer
IBM Security Systems Division
IBM Australia Development Laboratory
Office:  [phone]
Mobile: [phone]