09.06.09, 18:07, "Stuart Henderson" <s...@spacehopper.org>:
> The fix might be as simple as this, but it's totally untested, not > even compiled. > Index: if_pflow.c > =================================================================== > RCS file: /cvs/src/sys/net/if_pflow.c,v > retrieving revision 1.10 > diff -u -p -r1.10 if_pflow.c > --- if_pflow.c 27 Feb 2009 11:09:36 -0000 1.10 No, your patch is not a solution. Look: FLOW EXPORT TIME TIME INTERVAL | |----| | | | | F L SU,US,UNS F-FIRST,L-LAST SysUptime at start of the flow and at the time the last packet of the flow was received SU-SYSUPTIME from header, time in milliseconds since this device was first booted. US-Unix seconds from header, Seconds since 0000 Coordinated Universal Time (UTC) 1970. Time calculation formula (without nanoseconds): ------------------------------------------- Date/time at start of the flow = US - (SU-F)/1000 Date/time at end of the flow = US - (SU-L)/1000 example: flow collection begin with softflowd --------------------- UNIX_SECS=1244458921 # 2009-06-08 15:02:01+04 SYSUPTIME=363460 FIRST=60073 LAST=60090 --------------------- Date/time of first packet = US - (SU-F)/1000 = 1244458618 = 2009-06-08 14:56:58+04 All correct. example: flow collection with pflow before patch --------------------- UNIX_SECS=1244351870 # 2009-06-07 09:17:50 +04 SYSUPTIME=1119000 # FIRST=3106274456 # Why so huge ? LAST=3106291456 # ?? --------------------- Date/time of first packet = US - (SU-F)/1000 = 1244351870 - (-3105155) = 1247457025 = 2009-07-13 07:50:25+04 Incorrect. F and L time values must be lesser than UNIX_SECS example: flow collection with pflow after patch ------------ UNIX_SECS=1213083472 # 2008-06-10 11:37:52+04 SYSUPTIME=525000 FIRST=1902158528 # Also Huge. LAST=1902169528 # ?? --------------------- Date/time of first packet = US - (SU-F)/1000 = 1213083472 - (-1901633) = 2008-07-02 11:51:45+04 Incorrect. F and L time values must be lesser than UNIX_SECS
