1

I'm trying to convert AWS VPC Flow Logs into Netflow v9. Each VPC Flow Log record has start and end timestamps that I'd like to encode in a Netflow data record. Looking at the Netflow v9 spec, there doesn't seem to be any such field for this.

When I export my Netflow packet to a collector (specifically, Flowtraq), the time attached to the flow seems to be the time that the packet was exported.

Am I misunderstanding how Netflow works — is there really no way of specifying the start and end time of a flow?

Thanks in advance! 😊

Improve this question

1 Answer 1

Reset to default
1

There are types for that. For example:

Type 21 LAST_SWITCHED  - System uptime at which the last packet of this flow was switched
Type 22 FIRST_SWITCHED - System uptime at which the first packet of this flow was switched

You can calculate the actual time from the System Uptime and the UNIX Seconds from the header fields.

There are also vendor proprietary types that you could use for something like what you want to directly save the times.

Improve this answer
4
  • Thanks, you're totally right. The issue I see is that I now have to convert my UNIX timestamp for start and end into an artificial system uptime. It seems like I need to choose an arbitrary system uptime such that any possible flows I want to generate are encountered within this uptime. Is there any nicer way of doing this?
    – sidney
    Jan 21, 2020 at 4:59
  • You could simply use a couple of the vendor proprietary types for what you want. Select one to be the start and one to be the end. You then get to define the size, and you can interpret the value any way you want. That is the type of thing those are set aside for.
    – Ron Maupin ♦
    Jan 21, 2020 at 14:52
  • Thanks. I need my collector (Flowtraq) to be able to understand the data I'm sending, and as far as I can tell there's no way to do that. Is there something I'm misunderstanding about vendor proprietary types?
    – sidney
    Jan 21, 2020 at 23:34
  • Well, you were not clear about that. From the question it may be interpreted that you are programming both sides of this. I'm not sure what that particular collector does with that field type, although it should not cause any problems because it will have the field length included.
    – Ron Maupin ♦
    Jan 22, 2020 at 0:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.