Re: [IPFIX] Export of long lived flow information

[John Court <[e-mail]>]

Sorry one last bit is still niggling me.

I would think that if a flow was being reported because the Meter or 
Exporter wanted to reclaim resources, it would use the flowEndReason of 
"lack of resources 0x05".  This gives a clear indication that the flow is 
no longer being tracked and that any future record for that connection 
will be with a new flowStartTime.  I think that is why I considered it 
reasonable to maintain the original flowStartTime with the "active timeout 
0x02"  flowEndReason.

Of course reading it now I understand what was in the mind of the authors. 
 If the field had been "flowReportReason" rather than "flowEndReason" 
perhaps it could have dealt with the concepts updates more easily :-)

Thanks again.

John Court
Software Engineer
IBM Security Systems Division
IBM Australia Development Laboratory
Office:  [phone]
Mobile: [phone]