Long duration of Juniper flows

Juniper-specific behavior of flow timestamps.

Product: Flowmon Collector

Version: Any

Platform: Any

Juniper flow source has configured an active timeout of 5 minutes but some flows are much longer.

When the Juniper device splits flows by active timeout (a monitored session is longer than an active timeout), the session's start time persists and is propagated to the following flow.

Example of TCP session, 15 minutes long:
Standard behavior:
1. flow 12:00 - 12:05 (flow duration 5 minutes)
2. flow 12:05 - 12:10 (flow duration 5 minutes)
3. flow 12:10 - 12:15 (flow duration 5 minutes)

Juniper's behavior:
1. flow 12:00 - 12:05 (flow duration 5 minutes)
2. flow 12:00 - 12:10 (flow duration 10 minutes)
3. flow 12:00 - 12:15 (flow duration 15 minutes)

This behavior is Juniper-specific and cannot be changed.