First (flowstart) and last (flowstart) timestamps are not saved when receiving IPfix from VPP: 0000-00-00 00:00:00.000

[maxbur89]

First (flowstart) and last (flowstart) timestamps are not saved when receiving IPfix from VPP on February 26.
They always display "0000-00-00 00:00:00.000."
However, when viewed in WireShark, the time is displayed (see the attached screenshot for an example).
In WireShark: cflow.abstimestart Aug 2, 2026 12:22:23.039852399 +07.
Raw data in .pcap format is attached.

I posted a .pcap file and an example of an nfdump file on Google Drive:
https://drive.google.com/drive/folders/19tkHIw_cAzPx7A7dh8XqiRyRDjVm_F8h?usp=sharing

I suspect this is related to a change in VPP: in version 17.07, the flowprobe plugin changed the flowstartns and flowendns data types to nanoseconds instead of milliseconds. Flowprobe: Add flowstartns, flowendns and tcpcontrolbits (https://s3-docs.fd.io/vpp/26.10/aboutvpp/releasenotes/v17.07.html).

Version VPP:

vpp                           26.02-release

Config VPP:

set ipfix exporter collector 10.224.5.196 port 4739 src 10.255.255.178 template-interval 20 path-mtu 1450
flowprobe params record l3 l4 active 120 passive 300
flowprobe feature add-del Eth_cl ip4 both

The problem appears in all versions of nfdump:

/usr/local/bin/nfcapd -V
/usr/local/bin/nfcapd: Version: 1.7.8-3faa63c options: LZ4 ZSTD date: 2026-07-29 11:26:38 +0200

dpkg --list | grep nfdu
ii  nfdump                            1.7.5-2+deb13u1                      amd64        netflow capture daemon

IPfix collection is performed by nfcapd:
/usr/bin/nfcapd -D -P /run/nfcapd.ipfix1.pid -w /var/lib/nfdump/ipfix1 -b 10.224.5.196 -p 4739 -t 300 -z=lz4 -W 4 -I ipfix1 -B 134217728 -4

The template is passed:

tshark -i any -n -f "udp port 4739" -V | grep -iE "(flowstart|flowend)"
2389             Field (5/13): flowStartNanoseconds
                .000 0000 1001 1100 = Type: flowStartNanoseconds (156)
            Field (6/13): flowEndNanoseconds
                .000 0000 1001 1101 = Type: flowEndNanoseconds (157)
15068             Field (5/13): flowStartNanoseconds
                .000 0000 1001 1100 = Type: flowStartNanoseconds (156)
            Field (6/13): flowEndNanoseconds
                .000 0000 1001 1101 = Type: flowEndNanoseconds (157)

When I try to view the timestamp data, I see 0000-00-00 00:00:00.000.

Date first seen         Duration         Proto      Src IP Addr:Port          Dst IP Addr:Port   Packets    Bytes Flows
0000-00-00 00:00:00.000     00:00:00.000 TCP      176.65.144.44:59055 ->    31.43.195.186:1723         1       40     1
0000-00-00 00:00:00.000     00:00:00.000 TCP       94.26.68.134:59614 ->    31.43.213.250:44126        1       40     1
0000-00-00 00:00:00.000     00:00:00.000 UDP      31.43.192.164:39426 ->    185.231.32.69:33006        2     2132     1

nfdump -r nfcapd.202608021215 -o raw -c 1
Flow Record:
  RecordCount  =                  2
  Flags        =               0x00 NETFLOW v10, Unsampled
  Elements     =                  4: 1 2 4 12
  size         =                104
  engine type  =                  0
  engine ID    =                  0
  export sysid =                  1
  first        =                  0 [0000-00-00 00:00:00.000]
  last         =                  0 [0000-00-00 00:00:00.000]
  received at  =      1785647700001 [2026-08-02 12:15:00.001]
  proto        =                  6 TCP
  tcp flags    =               0x12 ...A..S.
  src port     =                443
  dst port     =               1282
  src tos      =                  0
  fwd status   =                  0
  in packets   =                  1
  in bytes     =                 40
  src addr     =     45.225.135.171
  dst addr     =      93.157.40.132
  input        =                  1
  output       =                  2
  src mask     =                  0 /0
  dst mask     =                  0 /0
  dst tos      =                  0
  direction    =                  1
  biFlow Dir   =               0x00
  end reason   =               0x00
  ip exporter  =     10.255.255.178