You need to enable flow sampling and bind it to the instance you created in
forwarding options and services on the fpc itself. Note that the FPC will
reboot when you do this if you are setting it up for the first time or
adjusting the flow table sizes.
Also note that the sampling rate you are playing with has no effect really.
Sampling with inline Flow is done at a 1:1 rate. The sample rate I believe
just sets the scaling factor. On all the installations I’ve done I’ve set the
rate to 1 as well with out negative impact to processing.
Hope that helps.
On Jul 9, 2015, at 1:14 PM, NetGuy
<networkcontr...@gmail.com<mailto:networkcontr...@gmail.com>> wrote:
Thanks for the response. Juniper docs are mixed about this (as usual). I
thought at first it might be this:
http://www.gossamer-threads.com/lists/nsp/juniper/42141
We're basically seeing extremely low bps/pps
There is another appliance inline that receives the flows, and replicates them
to the nfdump box. The other appliance seems fine.
Are we doing anything off base config wise for MS-MPC and templates? We
switched to 1:500 too. Still the same issue on nfdump.
I"ll probalby have to packet capture everything.
set services flow-monitoring version9 template template1 flow-active-timeout 120
set services flow-monitoring version9 template template1 flow-inactive-timeout
60
set services flow-monitoring version9 template template1 template-refresh-rate
packets 480000
set services flow-monitoring version9 template template1 template-refresh-rate
seconds 600
set services flow-monitoring version9 template template1 option-refresh-rate
packets 480000
set services flow-monitoring version9 template template1 option-refresh-rate
seconds 600
set services flow-monitoring version9 template template1 ipv4-template
set services service-set ss1 jflow-rules sampling
set services service-set ss1 sampling-service service-interface ms-5/0/0.0
set forwarding-options sampling input rate 500
set forwarding-options sampling input max-packets-per-second 65535
set forwarding-options sampling family inet output flow-server x.x.x.x port 9990
set forwarding-options sampling family inet output flow-server x.x.x.x
no-local-dump
set forwarding-options sampling family inet output flow-server x.x.x.x version9
template template1
set forwarding-options sampling family inet output interface ms-5/0/0.0
source-address x.x.x.x
Thanks for Everyones input
On Thu, Jul 9, 2015 at 8:49 AM, Michael Hare
<michael.h...@wisc.edu<mailto:michael.h...@wisc.edu>> wrote:
With MS-MPC and TRIO, when an active flow is timed out the JunOS exporter [v9
or ipfix] holds onto the original start time. The hardware -is supposed to-
blank the octets/packets counters.
Now, I've had a case open for several weeks with an MX2010/MPC4/12.3R8 where
occasionally i'm getting phantom flows exported [mostly proto ESP] with
errantly large octet/packet counters, but that's another story.
We use 1:256
-Michael
> -----Original Message-----
> From: sth...@nethelp.no<mailto:sth...@nethelp.no>
> [mailto:sth...@nethelp.no<mailto:sth...@nethelp.no>]
> Sent: Thursday, July 09, 2015 4:21 AM
> To: networkcontr...@gmail.com<mailto:networkcontr...@gmail.com>
> Cc:
> nfdump-discuss@lists.sourceforge.net<mailto:nfdump-discuss@lists.sourceforge.net>
> Subject: Re: [Nfdump-discuss] Juniper MX MS-MPC / DPC V9 Netflow
> pps/bps low?
>
> > Nfdump has been working fantastically for us until we upgraded to 1:1 with
> > an MS-MPC. It appears the MS-MPC on MX routers only support V9, and
> they
> > don't support aggregation.
> >
> > Everything was fine with Verison 5 Route Engine sampling. Now, at full
> > blown 1:1 sampling via MS-MPC, everything is way off. It starts out ok but
> > quickly gets out of sync after a few minutes. I read an earlier thread
> > about this being the way Juniper exports flows but doesn't remove them
> from
> > the table.
> >
> > Is this only a version 9 thing? Is there something I can do to timers? It
> > seems silly to get the ms-mpc only to get locked out of reliable reports
> > due to the way v9 on Junos is exported. Does anyone have any experience
> > with this?
>
> We use inline IPfix on Juniper Trio cards (MPC-3D-16XGE-SFPP, MX-MPC2-3D
> etc) with 1:100 sampling. No MS-MPC. Seems to work for us. We never
> needed or wanted 1:1.
>
> Steinar Haug, AS 2116
>
> ------------------------------------------------------------------------------
> Don't Limit Your Business. Reach for the Cloud.
> GigeNET's Cloud Solutions provide you with the tools and support that
> you need to offload your IT needs and focus on growing your business.
> Configured For All Businesses. Start Your Cloud Today.
> https://www.gigenetcloud.com/
> _______________________________________________
> Nfdump-discuss mailing list
> Nfdump-discuss@lists.sourceforge.net<mailto:Nfdump-discuss@lists.sourceforge.net>
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
------------------------------------------------------------------------------
Don't Limit Your Business. Reach for the Cloud.
GigeNET's Cloud Solutions provide you with the tools and support that
you need to offload your IT needs and focus on growing your business.
Configured For All Businesses. Start Your Cloud Today.
https://www.gigenetcloud.com/_______________________________________________
Nfdump-discuss mailing list
Nfdump-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
------------------------------------------------------------------------------
Don't Limit Your Business. Reach for the Cloud.
GigeNET's Cloud Solutions provide you with the tools and support that
you need to offload your IT needs and focus on growing your business.
Configured For All Businesses. Start Your Cloud Today.
https://www.gigenetcloud.com/
_______________________________________________
Nfdump-discuss mailing list
Nfdump-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
