Add sFlow

RouterOS RouterOS beta
1

Add sFlow

2

Perhaps they should start to FIX the broken IPFIX implementation to start with…

3

Is it broken in v7 only?

4

Nope, also in 6.4x
I’ve opened a case for that long ago … latest reply on 21/07.
Let’s hope the release-notes from any future 6.x release contain the fix. This is so very trivial. Probably never tested or something after coding it…how else could you miss this one.

Thank you for contacting MikroTik Support. And sorry for the late reply.
I have forwarded this information to developers and we’ll look into it. Likely flowStartMilliseconds and flowEndMilliseconds should be added and used here.

5

So what’s actually broken?..

6

Well … flowStartMilliseconds and flowEndMilliseconds fields in the template are not correctly embedded, putting 1970-01-01 00:00:00 (Epoch) in there. So basically useless.
I’ve tried some netflow tooling and they cannot really work with that IPFIX data like this. It should be embedded correctly.

As per spec :

(field 152) flowStartMilliseconds dateTimeMilliseconds default current The absolute timestamp of the first packet of this Flow.
(field 153) flowEndMilliseconds dateTimeMilliseconds default current The absolute timestamp of the last packet of this Flow.

7

This IPFIX issue was fixed YEARS ago. Maybe there was a regression!

8

Sflow is much lighter for cpu overload, specially on hardware off-load scenarios.

Please add sFlow support.

9

fisherdougles

please do not wake up every sFlow topic, especially that 5 years old ones. Start a new one and refer to the old ones. closing topic.

1 Like