When are FDR records generated for TCP, UDP, and ICMP flows traversing a PacketShaper?

book

Article ID: 167397

calendar_today

Updated On:

Products

PacketShaper

Issue/Introduction

By default, FDR records are generated at the beginning and end of each flow. For TCP and ICMP flows, PacketShaper is easily able to determine the beginning and end of the flow. (For ICMP, the ICMP echo is the beginning and the ICMP echo reply is the end of the flow.)

UDP flows are more difficult to handle since there is not a definitive beginning or end to most UDP flows. An exception would be a DNS query, where there is a request/response type of transaction.  For this reason, the only way to generate FDR records for most UDP flows is by enabling Intermediate FDR. This feature allows the PacketShaper to generate an FDR record for a flow at timed intervals rather than just at the beginning and end of a flow.  Currently Intelligence Center does not process Intermediate FDR,  though some third party collectors accept Intermediate FDRs.

Intermediate FDR is enabled with the “flowRecordsSendIntermediate” system variable using the following CLI command:

setup variable flowRecordsSendIntermediate  1

Intermediate FDRs are generated at 15,000 millisecond intervals, by default.  That interval can be changed with the flowRecordsIntermediateTimeout system variable. The minimum and maximum values are 1000 and 3,600,000 milliseconds respectively. To change the timeout value to 2500, you would enter the following CLI command:

setup variable flowRecordsIntermediateTimeout 2500