-
Bug
-
Resolution: Done
-
Major
-
None
-
None
-
None
-
Quality / Stability / Reliability
-
False
-
-
None
-
None
-
None
-
None
-
NetObserv - Sprint 218, NetObserv - Sprint 219
-
None
-
None
-
None
The TimeReceived field in IPFIX contains the number of seconds since the Unix epoch. It needs to be at least in milliseconds. When it's in seconds, many flows will end up with the same timestamp and therefore, there is a chance it can display the transaction in the wrong order.
See screenshot where two HTTP requests were made, and the flows sorted with the newest ones at the top. The last two rows show the response appearing before the request (last row is the response and second to last row is the request)! In the first two rows, it is in the right order.
—
Side note: It is not necessary for TimeFlowStart and TimeFlowEnd fields to be in milliseconds.