netsampler
Fix: consider relative ipfix timestamps
The builtin netflow exporter of mikrotik routers uses the fields
- flowStartSysUpTime (22)
- flowEndSysUpTime (21)
- systemInitTimeMilliseconds (160)
to determine the flow start and end timestamps at millisecond precision by adding the relative values of flowStart and flowEnd to the system init time.
These fields are not yet considered by goflow2 and hence the timestamps were left at their default value that corresponds to the export time. This fix is a quick and dirty workaround to address this problem. Caution: The logic only works if the systemInitTimeMilliseconds field appears after the flowStartSysUpTime/flowEndSysUpTime in the set, which is the case for IPFIX packets originated from the Mikrotik netflow exporter. I'm not sure if this is a MUST, hence the caveat.
@ruru0x thank you for your PR This will require tests Do you have a sample pcap? My impression is this change introduce some edge cases based on the order of fields in the template
