netsampler
handle netflow v9 uptime rollover
Netflow v9 FIRST_SWITCHED and LAST_SWITCHED are expressed as uptimes. goflow2 calculates the diff between sysUptime in the header with these times, to subtract from baseTime (Unix seconds/epoch), to determine the real times.
Edge case: sysUptime is a uint32 in the header (milliseconds). It will roll over after ~49.7 days of device uptime If a flow/flows occur across this rollover, goflow2 calculates time_flow_start_ns as being ~49.7 days in the future
Example: sysUptime has rolled over to 0, or a low number FIRST_SWITCHED is still a large number, near max uint32 value
Original calculation: timeDiff := (uptimeNs - uint64(timeFirstSwitched)*1e6)
Subtracting a large number (timeFirstSwitched) from a small number(uptimeNs) causes a wrap around, resulting in a large value.
We observed this in our production data and tracked it down/fixed the issue. Sharing if you're interested in adapting/integrating this fix.
