From 9247511c44d2c47dd5433c7ba11f2653f0a4f99d Mon Sep 17 00:00:00 2001 From: Adrian Moreno Date: Wed, 8 Sep 2021 17:08:04 +0200 Subject: [PATCH] ipfix: support relative flow timestamps IPFIX supports sending flowEndDeltaMicroseconds (159) and flowEndDeltaMicroseconds (160) to provide flow timestamps relative to the exportTime in the IPFIX Message Header. Use them to calculate flow TimeFlowStart and TimeFlowEnd. Signed-off-by: Adrian Moreno --- producer/producer_nf.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/producer/producer_nf.go b/producer/producer_nf.go index f895616..7786f0f 100644 --- a/producer/producer_nf.go +++ b/producer/producer_nf.go @@ -332,6 +332,12 @@ func ConvertNetFlowDataSet(version uint16, baseTime uint32, uptime uint32, recor case netflow.IPFIX_FIELD_flowEndNanoseconds: DecodeUNumber(v, &time) flowMessage.TimeFlowEnd = time / 1000000000 + case netflow.IPFIX_FIELD_flowStartDeltaMicroseconds: + DecodeUNumber(v, &time) + flowMessage.TimeFlowStart = uint64(baseTime) - time/1000000 + case netflow.IPFIX_FIELD_flowEndDeltaMicroseconds: + DecodeUNumber(v, &time) + flowMessage.TimeFlowEnd = uint64(baseTime) - time/1000000 } } }