Wrong timestamp of the flow

Timestamp of the flow is in the past or the future.

Product: Flowmon

Version: any

Platform: any

Incorrect timestamps usually occur if the flow source is a third-party device. Relative timestamps are sent in netflow v9 or IPFIX if there is missing SysUptime information or this value is incorrect.

For verification:

1. Create packet capture by tcpdump, eg:
tcpdump -i eth0 -w /tmp/flows.pcap 'host <flow_source_IP>

2. Calculate the timestamp of the flow and compare this value in the advanced analysis.

SysUptime -> time in seconds since the device boot/flow export initialization.
CurrentSecs -> absolute timestamp of packet export with flow data (time in seconds from 1.1.1970).
The relative timestamp calculation is for each flow:
CurrentSecs - SysUptime + StartTime/EndTime (start/end time in seconds).

1. Ask support of the flow source manufacturer, if this device can send absolute timestamps.
2. In FOS 12.2, the timestamps can be fixed on the listening port (Configuration Center - FMC Configuration - Listening ports - Edit - Adjust flow timestamps to the flow receive time) This feature uses receive time of the collector as an end time and "receive time of the collector - duration" as a start time.
   This avoids a wrong timestamp calculation based on an incorrect SysUptime value.