Mailing List Archive: Weird First / Last Seen Dates

Weird First / Last Seen Dates

Oct 3, 2016, 12:52 AM

Post #1 of 3 (593 views)

Hello,

I have a sonicwall exporting flow data by ipfix to a nprobe collector and
then ntop pro analyzing it, however all of the first/last seen dates are:
01/01/1970 09:00:01

so all flows show a duration of less than 1 second.

The dates are correctly configured on the router and collector.

Has anyone seen this before?

Thanks.
Takuan

Re: Weird First / Last Seen Dates [ In reply to ]

deri at ntop

Oct 3, 2016, 12:53 AM

Post #2 of 3 (583 views)

Permalink

Taken
this might be due to poor flow information exported by the Sonicwall.

Can you please send me (not to everyone) a pcap with flows+templates sent from your Sonicwall so I can see what happens?

Regards Luca

> On 3 Oct 2016, at 09:52, ç”°ä¸ã‚¶ãƒƒã‚¯ <takuan4@gmail.com> wrote:
>
> Hello,
>
> I have a sonicwall exporting flow data by ipfix to a nprobe collector and then ntop pro analyzing it, however all of the first/last seen dates are:
> 01/01/1970 09:00:01
>
> so all flows show a duration of less than 1 second.
>
> The dates are correctly configured on the router and collector.
>
> Has anyone seen this before?
>
> Thanks.
> Takuan
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop