[Flow-tools] flow-stat summary problem

[David Mitchell]

Greetings,

I've hit what appears to be a bug in flow-stat. In our flow files
(exported from JunOS) the first and last time entries fall into two sets
of values. One is a pretty standard and reasonable value such as
1235577361, but some flows have values which are offset and are more in
the range of 3732739987. The result is that flow-stat generates a bogus
value for duration and hence average bandwidth:

Duration of data  (realtime)    : 300
Duration of data (1/1000 secs)  : 2497164628

Average Kbits / second (flow)   : 0.0433
Average Kbits / second (real)   : 360.4539

I would write this off as being a problem with my flows, but flow-print
has no problem printing the flows with correct first and last time
values. flow-print calls the function ftltime() to massage the values,
as opposed to flow-stat which just uses the raw first and last values.
Should flow-stat be calling ftltime() as well? I haven't looked into
this too deeply, and most of the time I can just use the (realtime)
values. The little bit of poking around I did do though made me think
that this could be fixed, but I'm not sure where to get access to all
the values ftltime() needs in flow-stat. Is this a known bug though?

-David Mitchell

-- 
-----------------------------------------------------------------
| David Mitchell (mitchell at ucar.edu)       Network Engineer IV  |
| Tel: (303) 497-1845                      National Center for  |
| FAX: (303) 497-1818                      Atmospheric Research |
-----------------------------------------------------------------