1

Is possible to consider via IPFIX only the first n seconds of a flow (statistics)? How to set this in OpenVSwitch if possible?

  • IPFIX aggregates statistics from sampling flows, it doesn't actually send a flow. – Ron Maupin Feb 15 '17 at 19:40
  • Maybe I expressed myself badly. I want consider only the first n seconds (at the most) of a flow for the calculation of statistics. Always if possible. – 232376544333 Feb 15 '17 at 19:49
  • 1
    You can adjust the sample rate, and you can ignore anything beyond the time period you don't want., but I don't think you are going to get every packet in a flow for a given time period. That isn't how it is built. – Ron Maupin Feb 15 '17 at 19:51
  • 2
    Why do you want to do this? It doesn't really make sense to me. – Ron Trunk Feb 15 '17 at 20:02
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 6 '17 at 20:46
2

So you need to understand how a given switching device defines a flow. There's the obvious identifying stuff - the tuple of source and destination port/address, IP protocol number, etc. There's also clearly a beginning time and, of course, an end time.

The beginning is pretty straightforward. It's the first point at which the identifying tuple is observed. The ending, however, is a lot trickier. In the case of a TCP session seeing a FIN sequence might trigger a stop time but generally the flow end-time is going to be caused by either a timeout (i.e. a UDP session where a packet hasn't been seen in n seconds) or - much more likely in practice - the flow cache filled up and space is made for new flows by triggering the purge and export of older ones.

The thing is that the flow (as we've defined it) might not actually be over. Indeed, a long-lived flow might actually be represented by many consecutive flow records. It's the job of the analysis tool to tie all of these individual records together into some kind of sane whole.

It's for this reason that your question doesn't really make sense. The actual flow collector/exporter likely has no idea whether the flow cache entry it's working from represents the beginning or end of the actual flow on the wire. One of the nasty truths about flow-based collection mechanisms is that the relatively limited size of the cache means that a suitably large variation in identifying tuples on the wire can lead to a degenerate case where a flow record only sees a few packets before being pushed out. This is why the use of these kinds of analytics on large-scale Internet core boxes tends to be pretty limited and in the places where flow-based measurement is occurring (aggregation/edge platforms) that it's almost exclusively sampled.

So - if you want to only look at the first few seconds of a flow then set the aging time on the collection device to be very short. This will result in lots of flow records being exported (and lots more resources consumed) but will give you data on a very short interval. In turn, at the point of analysis you can choose to ignore all but the first record generated. I don't see the win to such an approach, but it at least nominally fits what you're asking for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.