Netflow timestamp

[francisco_1]

Attached is the raw netflow export i captured.  The SysUptime value of "3403894224"  that appears in the netflow header is the interval in milli-seconds since the last time the router was rebooted. The StartTime within that of 3403684 seconds is supposed to be the SysUptime at the time the flow record was created. In this case, the StartTime in milliseconds 3403684 is greater than the SysUptime in the header 3403894224 which does not make sense since the SysUptime at the start of the flow should be less than the SysUptime of the router at the time of netflow export.

Any Ideas?

The Platform is 7304 IOS 122-31.sb6

Francisco

[Hayabusa.CA]

Forgive me if I misunderstood you.

SysUptime = 3403894224

StartTime = 3403684

SysUptime is greater than StartTime.

[francisco_1]

In the attachement, the SysUptime is the interval in milliseconds, The starttime is in seconds..

See the other attachment that might make more sense.