Re: [Nfdump-discuss] ipfix date and time problem

[Peter H. <ph...@us...>]

This seems to be related to your exporter. The timstamps are decoded accordingly, but the values found are way out and
look invalid.

	- Peter

On 25.04.14 12:03, Varun Sharma wrote:
> Hi ,
> 
> I am using nfcapd for collecting ipfix flows.I am seeing issue with date
> and time field . I am using 152 and 153 tag for timestamp field.
> 
> data sample ....
> 
> $ nfdump -r nfcapd.201404251111
> 
> 
> Date first seen          Duration Proto      Src IP Addr:Port          Dst
> IP Addr:Port   Packets    Bytes Flows
> *1985-12-04 07:56:13.632* 17179869.184 TCP      10.208.14.238:22    ->
> 10.208.14.234:49202      520        2     1
> 
> *1986-01-23 00:59:00.928* 897648164.864 TCP      10.208.14.234:49202 ->
> 10.208.14.238:22          80        2     1
> 
> *2057-12-03 01:31:13.216* 68719476.736 UDP      10.208.14.106:57066 ->
> 239.255.255.250:1900       912        6     1
> 
> *2078-06-22 07:32:14.912* 429496729.600 UDP      10.208.14.115:49940 ->
> 224.0.0.252:5355        96        2     1
> 
> *2061-08-06 05:46:30.208* 21474836.480 UDP       10.208.14.78:37603 ->
> 10.208.15.255:111        256        2     1
> 
> *2008-03-30 19:33:30.176* 429496729.600 UDP       10.208.14.50:54528 ->
> 224.0.0.252:5355       110        2     1
> 
> 
> *:::*
> Summary: total flows: 49, total bytes: 121, total packets: 31134, avg bps:
> 0, avg pps: 0, avg bpp: 0
> Time window: *2042-12-13 22:24:30 - 2076-11-02* 18:58:47
> Total flows processed: 49, Blocks skipped: 0, Bytes read: 2648
> Sys: 0.002s flows/second: 16338.8    Wall: 0.001s flows/second: 37867.1
> 
> 
> I attached tcpdump pcap file also. Pls find attachment.
> 
> can anybody know why it's happening ?
> 
> Thanks
> 
> 
> Regards
> varun
> 
> 
> 
> ------------------------------------------------------------------------------
> Start Your Social Network Today - Download eXo Platform
> Build your Enterprise Intranet with eXo Platform Software
> Java Based Open Source Intranet - Social, Extensible, Cloud Ready
> Get Started Now And Turn Your Intranet Into A Collaboration Platform
> http://p.sf.net/sfu/ExoPlatform
> 
> 
> 
> _______________________________________________
> Nfdump-discuss mailing list
> Nfd...@li...
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
> 

-- 
Be nice to your netflow data. Use NfSen and nfdump :)