Bug 1760 - Timestamp offset using softflowd with nfdump
Summary: Timestamp offset using softflowd with nfdump
Status: CLOSED FIXED
Alias: None
Product: softflowd
Classification: Unclassified
Component: softflowd (show other bugs)
Version: -current
Hardware: ix86 Linux
: P2 major
Assignee: Damien Miller
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-04-21 08:49 AEST by Stephen Nelson
Modified: 2011-01-24 12:33 AEDT (History)
2 users (show)

See Also:


Attachments
Fixes bug by switching the order of first and last switched fields in the NF9_SOFTFLOWD_DATA_COMMON struct (598 bytes, patch)
2010-05-04 12:18 AEST, Stephen Nelson
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Stephen Nelson 2010-04-21 08:49:22 AEST
Using softflowd with nfdump on ubuntu. All tcp flows are off by about 4294717.379 seconds. This is suspiciously similar to the size of an unsigned integer in milliseconds. Several google hits of people reporting this to the nfdump mailing lists and others, discussion there indicated that it wasn't a nfdump problem.
Comment 1 Stephen Nelson 2010-05-04 12:15:57 AEST
Turns out that this is because softflow is still mixing the first_switched and last_switched fields in netflow9 output. These have been corrected in the header, but the struct which they are actually written to is wrong. Patch attached.

Confirmation of this bug can be obtained by examining a softflowd packet using wireshark's "CFLOW" decoder. If the packet includes the template then wireshark will show that the last_switched field is greater than the first_swtiched field. After applying the submitted patch, the fields are in the correct order.
Comment 2 Stephen Nelson 2010-05-04 12:18:26 AEST
Created attachment 1845 [details]
Fixes bug by switching the order of first and last switched fields in the NF9_SOFTFLOWD_DATA_COMMON struct
Comment 3 Damien Miller 2010-05-04 12:21:55 AEST
nice work - thanks. I have applied the patch and it will be in softflowd-0.9.9.
Comment 4 screw 2010-06-21 10:00:01 AEST
using last build from http://www.mindrot.org/softflowd_snap/ (with applied bugfix) on ubuntu with nfcapd (1.6.1) and still getting bad timestamps with -v 5 and completely wrong result(wrong/no IP, wrong/no port,...) with -v 9.
Comment 5 Damien Miller 2010-06-21 10:42:53 AEST
I think nfdump on Ubuntu is broken. It seems to decode the first flow in a softflowd netflow 9 export packet correctly (and has correct timers), but subsequent ones are corrupt. It is probably failing to calculate an increment length correctly when skipping to the end of a flow.

nfdump seems to decode v.5 flows correctly in all cases and has correct timestamps.

Wireshark decodes the flows correctly and gives correct times for both v5 and v9 flows.
Comment 6 Damien Miller 2011-01-24 12:33:32 AEDT
Move resolved bugs to CLOSED after 5.7 release