Yes -- this is on Juniper IPFIX. Elisa: I can try to capture an 'errant' flow packet.
Paolo: That seems like a good work around. Thanks. I've fought a lot with the docs, maybe they don't match my learning style. (would it be possible to try to add some internal linking/anchors in the doc?) A FAQ might be in order too based on historical mailing list Qs? Want some help trying to put this together? --Joel On Tue, Feb 25, 2014 at 9:51 AM, Paolo Lucente <pa...@pmacct.net> wrote: > Hi Joel, > > On top of Elisa's answer, inline: > > On Mon, Feb 24, 2014 at 07:30:38PM -0800, Joel Krauska wrote: > > > > Any way to override the flow timestamps with some actual time window > data? > > Yes, nfacctd_time_new set to true. Feel free to read docs and > give it a try. Unless: a) timers are set short (ie. less than > one minute imho) on the router, also for active flows!, and b) > such timers are honoured for true (ie. these timestamps well > in the past are only result of a timestamp reporting bug and > flows are actual instead) - going this way might not give you > the expected solution. > > Cheers, > Paolo > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists >
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
