Uploaded image for project: 'Network Observability'
  1. Network Observability
  2. NETOBSERV-265

Time received for IPFIX needs to be in milliseconds

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • None
    • None
    • Console Plugin, Loki
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • NetObserv - Sprint 218, NetObserv - Sprint 219
    • None
    • None
    • None

      The TimeReceived field in IPFIX contains the number of seconds since the Unix epoch.  It needs to be at least in milliseconds.  When it's in seconds, many flows will end up with the same timestamp and therefore, there is a chance it can display the transaction in the wrong order.

      See screenshot where two HTTP requests were made, and the flows sorted with the newest ones at the top.  The last two rows show the response appearing before the request (last row is the response and second to last row is the request)!  In the first two rows, it is in the right order.

      Side note: It is not necessary for TimeFlowStart and TimeFlowEnd fields to be in milliseconds. 

              jtakvori Joel Takvorian
              stlee@redhat.com Steven Lee
              None
              None
              None
              None
              None
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: