On 01/07/2016 17:47, Tom Hill wrote:
If the time is correct in the exported packets, then it makes me wonder
which version of nfdump you're using.
"If" though.
We've had persistent problems with wrong timestamps on some Cisco
platforms (not OPs ASR1k though). I've currently got the N7k BU telling
me the CPU and ASIC have different clocks so it's expected that the
netflow export timestamps are wrong, forever. They're refusing to give
me a documentation update of this as a platform limit.
I think it's unlikely ASR1k has that issue, but OP could test; capture
the packets, examine/decode in Wireshark, compare known test traffic w/
good wall-clock timestamps against the values in the flow. Need to be
sure you capture the template records too.
If the in-packet flow timestamps look good, it's probably a
template/field interpretation bug/difference b/w nfsen and ASR.
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
