pflow(4): pflowproto 9

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

pflow(4): pflowproto 9

Florian Obser-2
Since we are in -beta you are all starting to test snapshots like
crazy, right? Right?!
Please do me a favor, if you're using pflow(4) test if your favorite
collector works with  pflowproto 10.
Since the time_t cleanup (rev 1.34 of if_pflow.c) v10 no longer sends
insane flows. I know it now works with nfsense.
I'd like to remove v9 for 5.6 and would like to now how big the fallout
is. If you're using v9 and your collector doesn't work with v10
consider prodding your vendor or write patches.

Of course there is a reason for this. In the beginning v9 and v10 were
using the same code paths. It turned out this was no longer possible
after the time_t cleanup. v10 has 64 bit time counters, v9 has
not. So there is a lot of nearly but not quite the same code. I'd like
to get rid of half of it. Also v9 is unfixable post 2038. Since v10 is a
standard and can do at least as much as v9 there is no reason to keep
v9.
Thanks,
Florian

--
I'm not entirely sure you are real.

Reply | Threaded
Open this post in threaded view
|

Re: pflow(4): pflowproto 9

Florian Obser-2
To clarify, since I got a private mail from a v5 user:
v5 is going to stay for now. It's beyond repair wrt. 2038 but other
than that it's a perfectly fine protocol if you only need to export
IPv4 flows. Also it's not in the way of improving v10 like v9 is.

So I'm not asking you to migrate from v5 to v10, however if
you have some obscure collector maybe you can give v10 a quick spin
and see if the collector accepts the flows.

However you very likely need to migrate from v9 to v10 in the not to
distant future. (after 5.5 of course)

On Thu, Jan 23, 2014 at 10:08:04AM +0000, Florian Obser wrote:

> Since we are in -beta you are all starting to test snapshots like
> crazy, right? Right?!
> Please do me a favor, if you're using pflow(4) test if your favorite
> collector works with  pflowproto 10.
> Since the time_t cleanup (rev 1.34 of if_pflow.c) v10 no longer sends
> insane flows. I know it now works with nfsense.
> I'd like to remove v9 for 5.6 and would like to now how big the fallout
> is. If you're using v9 and your collector doesn't work with v10
> consider prodding your vendor or write patches.
>
> Of course there is a reason for this. In the beginning v9 and v10 were
> using the same code paths. It turned out this was no longer possible
> after the time_t cleanup. v10 has 64 bit time counters, v9 has
> not. So there is a lot of nearly but not quite the same code. I'd like
> to get rid of half of it. Also v9 is unfixable post 2038. Since v10 is a
> standard and can do at least as much as v9 there is no reason to keep
> v9.
> Thanks,
> Florian
>
> --
> I'm not entirely sure you are real.
>

--
I'm not entirely sure you are real.