Mixed up Timestamps in Netflow

Hi everbody,

I've got a strange issue regarding the timestamp when displaying exported netflow data from several fortigates with nfdump.

The issues's as follows:

I setup netflow in my main FGT90D running 5.2.3 and exported these data into a nfdump/nfsen collector/analyzer. Here I got flows which seemed to be first seen in future. First there'd been flows with a timestamp from september 13. Today in the morning the timestamps matched my time but up to now they're some 24 hours ahead.

So I setup another FGT100D with 5.2.3 and it's timestamps are around 5 hours and ten minutes ahead.

So I setup a third fortigate, another 100D with 5.2.4 and finally it's timestamps seem to match my actual time.

I'm researching this issue for several days now - meanwhile implementing an Cisco 3620 Router - netflow enabled and two distributed Switches from my ESX-Farm sending it's data into the collector - just to be sure that it's no general issue. Countless times I set up ntp configurations and configured timezones just to be sure.

But whatever I tried up to now, these timing offsets only are to be seen from the fortigates, especially from the two boxes running 5.2.3. What's a little bit worse is that the timeshift seem to vary - as wrote above from my FGT90D so that you even can't just calculate with a fix time offset to get it right.

One strange thing I discovered - but I don't know if it's by design or not because I no netflow-packet sepcialist. I captured those netflow packets from all three boxes and discovered the FGT100D running 5.2.3 is sending packets with a negative sysuptime value. The other two have positive ones. Don't know if it's just a byte-overflow issue or something like that.

Has anyone playing aroung with netflow seen anything like that and could give me a hint where to look next?

If it's important, my collector/analyzer is running nfdum/nfsen on debian 8 - if it got something to do with it.