Long duration of Juniper flows
Juniper-specific behavior of flow timestamps.
Product: Flowmon Collector
Juniper flow source has configured an active timeout of 5 minutes but some flows are much longer.
|Steps to Reproduce:|
When the Juniper device splits flows by active timeout (a monitored session is longer than an active timeout), the session's start time persists and is propagated to the following flow.
Example of TCP session, 15 minutes long:
This behavior is Juniper-specific and cannot be changed.