IPFIX - consider only first n seconds of a flow

Question

Is possible to consider via IPFIX only the first n seconds of a flow (statistics)? How to set this in OpenVSwitch if possible?

Answer 1

So you need to understand how a given switching device defines a flow. There's the obvious identifying stuff - the tuple of source and destination port/address, IP protocol number, etc. There's also clearly a beginning time and, of course, an end time.

The beginning is pretty straightforward. It's the first point at which the identifying tuple is observed. The ending, however, is a lot trickier. In the case of a TCP session seeing a FIN sequence might trigger a stop time but generally the flow end-time is going to be caused by either a timeout (i.e. a UDP session where a packet hasn't been seen in n seconds) or - much more likely in practice - the flow cache filled up and space is made for new flows by triggering the purge and export of older ones.

The thing is that the flow (as we've defined it) might not actually be over. Indeed, a long-lived flow might actually be represented by many consecutive flow records. It's the job of the analysis tool to tie all of these individual records together into some kind of sane whole.

It's for this reason that your question doesn't really make sense. The actual flow collector/exporter likely has no idea whether the flow cache entry it's working from represents the beginning or end of the actual flow on the wire. One of the nasty truths about flow-based collection mechanisms is that the relatively limited size of the cache means that a suitably large variation in identifying tuples on the wire can lead to a degenerate case where a flow record only sees a few packets before being pushed out. This is why the use of these kinds of analytics on large-scale Internet core boxes tends to be pretty limited and in the places where flow-based measurement is occurring (aggregation/edge platforms) that it's almost exclusively sampled.

So - if you want to only look at the first few seconds of a flow then set the aging time on the collection device to be very short. This will result in lots of flow records being exported (and lots more resources consumed) but will give you data on a very short interval. In turn, at the point of analysis you can choose to ignore all but the first record generated. I don't see the win to such an approach, but it at least nominally fits what you're asking for.