cvs commit: src/sys/netgraph/netflow netflow.c

[Bruce A. Mah]

If memory serves me right, Brooks Davis wrote:
> On Thu, Mar 03, 2005 at 11:01:06AM +0000, Gleb Smirnoff wrote:
> > glebius     2005-03-03 11:01:06 UTC
> > 
> >   FreeBSD src repository
> > 
> >   Modified files:
> >     sys/netgraph/netflow netflow.c 
> >   Log:
> >   Cisco uses milliseconds for uptime. This is stupid. Nobody cares of such
> >   precision when IP packet may travel through internet for several seconds.
> >   Also uptime measured in milliseconds overflows every 48+ days.
> >   But we have to do same to keep compatibility with Cisco and flow-tools.
> >   
> >   Make a macro MILLIUPTIME, which does overflowable multiplication to 1000.
> 
> JFYI, I know of applications that care about even higher granularity.
> For instance, I talked to one of the people from Panasas this fall who
> would really like the kernel timer interface to be able to handle
> sub-millisecond timeouts.  In their environment, at packet that has not
> been acked in around 100 microseconds has been dropped!

What's also odd is that NetFlow (at least the versions I work with)
timestamps the export packets with nanosecond precision, then uses the
"uptime-in-milliseconds" timestamp for both the packet and the
individual NetFlow records.  You have to do some weird arithmetic to get
the "real" timestamps of the NetFlow records.  (And if you have only
millisecond precision offsets for the individual records, what's the
point of nanosecond precision for the whole clump of them?)

(This of course does not address the *accuracy* of the measurements
which is a whole 'nother story.)

Bruce.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.freebsd.org/pipermail/cvs-src/attachments/20050303/8d3af1ae/attachment.bin