Subject: [ipfix-arch] RE: IPFIX Architecture - timestamps...

From: Ganesh Sadasivan <[email-masked]>
Date: Wed, 06 Feb 2002 20:22:40 -0800

Hello,

About the timestamp issue...

Can't we use TCP's timestamp option instead of putting this on the flow
header? It's a timestamp and it's already there. yeah,
then it would not work for UDP. But then that might another thing for
the capability negotiation phase...
===========================================
[G] The timestamp  stuck in a flow record when the flow sees the first
and
last packet. It has nothing to do with the time when it is transported.
The timestamp in the flow  header however is the time when the flows are

packetized. This could be off from the actual time when the packet is
sent out
by TCP by 10-100msec depending on the implementation.  It is an extra 10
bytes
per packet for Timestamp option and it is an "option".
IMO, this field should be protocol independent and should be part of the
flow header.
Thanks
Ganesh
============================================
regards,

Reinaldo

-----Original Message-----
From: Penno, Reinaldo [SC9:T327:EXCH]
Sent: Wednesday, February 06, 2002 6:47 PM
To: Ganesh Sadasivan; [email-masked]
Cc: KC' 'Norseth; [email-masked];
[email-masked];
[email-masked]; [email-masked]

Subject: [ipfix-arch] RE: IPFIX Architecture

G:
If we have the timestamp per flow why is resequencing required
G:
[Reinaldo] humm...I need to think more about this one...

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Benoit Claise <[email-masked]>
Date: Thu, 07 Feb 2002 10:45:30 +0100

Hi,

Ganesh Sadasivan wrote:

> by TCP by 10-100msec depending on the implementation.

Just to add in Ganesh's direction...
And don't forget that a flow can stay a variable time in the cache if it's still
active.
So you can not compute anymore the UTC time the first packet was seen in a flow,
if you only use the TCP timestamp.

Regards, Benoit

> It is an extra 10