I'm trying to convert AWS VPC Flow Logs into Netflow v9. Each VPC Flow Log record has
end timestamps that I'd like to encode in a Netflow data record. Looking at the Netflow v9 spec, there doesn't seem to be any such field for this.
When I export my Netflow packet to a collector (specifically, Flowtraq), the time attached to the flow seems to be the time that the packet was exported.
Am I misunderstanding how Netflow works — is there really no way of specifying the start and end time of a flow?
Thanks in advance! 😊