What happens when "INFO: TCP IPFIX Collector: Closing X.X.X.X:Y" log is recorded

[sgLancelot]

Hi team, with TCP IPFIX input plugin, does this mean that a TCP FIN flag is received from the input?

What happens if I do not receive a TCP FIN flag but an exporter is no longer sending anything to ipfixcol2? Does that TCP connection get closed after automatically after some time?

[sedmicha]

Hello!

The session lifetime is fully dependent on TCP, so as long as the TCP connection stays open, the IPFIX session does as well, even if no data is being sent. The collector does not automatically close connections on its own, except for one situation, which is if the collector received corrupted/invalid IPFIX data which it couldn't parse. That means that the log message you're asking about was either caused by the TCP connection being terminated by the other side (or somewhere along the way), or by the other side sending invalid data (in which case you would've probably also noticed some error/warning messages logged).