Community discussions

MikroTik App
 
neutronlaser
Member
Member
Topic Author
Posts: 445
Joined: Thu Jan 18, 2018 5:18 pm

Add sFlow

Wed Aug 26, 2020 7:11 pm

Add sFlow
 
User avatar
jvanhambelgium
Forum Veteran
Forum Veteran
Posts: 985
Joined: Thu Jul 14, 2016 9:29 pm
Location: Belgium

Re: Add sFlow

Wed Aug 26, 2020 7:50 pm

Add sFlow
Perhaps they should start to FIX the broken IPFIX implementation to start with...
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8709
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Add sFlow

Wed Aug 26, 2020 10:14 pm

Is it broken in v7 only?
 
User avatar
jvanhambelgium
Forum Veteran
Forum Veteran
Posts: 985
Joined: Thu Jul 14, 2016 9:29 pm
Location: Belgium

Re: Add sFlow

Wed Aug 26, 2020 10:42 pm

Is it broken in v7 only?
Nope, also in 6.4x
I've opened a case for that long ago ... latest reply on 21/07.
Let's hope the release-notes from any future 6.x release contain the fix. This is so very trivial. Probably never tested or something after coding it....how else could you miss this one.
-------------
Thank you for contacting MikroTik Support. And sorry for the late reply.
I have forwarded this information to developers and we'll look into it. Likely flowStartMilliseconds and flowEndMilliseconds should be added and used here.
------------
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8709
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Add sFlow

Wed Aug 26, 2020 10:58 pm

So what's actually broken?..
 
User avatar
jvanhambelgium
Forum Veteran
Forum Veteran
Posts: 985
Joined: Thu Jul 14, 2016 9:29 pm
Location: Belgium

Re: Add sFlow

Wed Aug 26, 2020 11:48 pm

So what's actually broken?..
Well ... flowStartMilliseconds and flowEndMilliseconds fields in the template are not correctly embedded, putting 1970-01-01 00:00:00 (Epoch) in there. So basically useless.
I've tried some netflow tooling and they cannot really work with that IPFIX data like this. It should be embedded correctly.

As per spec :

(field 152) flowStartMilliseconds dateTimeMilliseconds default current The absolute timestamp of the first packet of this Flow.
(field 153) flowEndMilliseconds dateTimeMilliseconds default current The absolute timestamp of the last packet of this Flow.
 
User avatar
nz_monkey
Forum Guru
Forum Guru
Posts: 2095
Joined: Mon Jan 14, 2008 1:53 pm
Location: Over the Rainbow
Contact:

Re: Add sFlow

Thu Aug 27, 2020 7:23 am

This IPFIX issue was fixed YEARS ago. Maybe there was a regression!

Who is online

Users browsing this forum: No registered users and 20 guests