Kemp Support, how can we help?

The latest application delivery knowledge and expertise at your fingertips.

Wrong timestamp of the flow

 

Information

 

Summary:

Timestamp of the flow is in the past or the future.

Environment:

Product: Flowmon

Version: any

Platform: any

Question/Problem Description: In advanced analysis are flows that differ with the selected time interval.
Steps to Reproduce:  
Error Message:  
Defect Number:  
Enhancement Number:  
Cause:

Incorrect timestamps usually occure if the flow source is a third party device.  Relative timestamps are send in IPFIX but there is missing SysUptime information or this value is incorrect.

For verification:

1. Create packet capture by tcpdump, eg:
tcpdump -i eth0 -w /tmp/flows.pcap 'host <flow_source_IP>

2. Calculate the timestamp of the flow and compare this value in the advanced analysis.

SysUptime -> time in seconds since the device boot/flow export initialization.
CurrentSecs -> absolute timestamp of packet export with flow data (time in seconds from 1.1.1970).
The relative timestamp calculation is for each flow:
CurrentSecs - SysUptime + StartTime/EndTime (start/end time in seconds).

Resolution:
  1. Ask support of the flow source manufacturer, if this device can send absolute timestamps.
  2. In the FOS 12.2. the timestamps will be counted differently (receive time of the collector = end time
    receive time of the collector - duration = start time ). This avoids a wrong timestamp calculation based on incorrect values.
Workaround:  
Notes: mceclip0.png

Comments