Hi,
I have tested IPFix ("Netflow") export from an MX80 running 12.1R1.9.
Im a bit baffled by the way it exports the flows. A dump
of the flows collected can be seen here: http://pastebin.com/6AziqBC2
The dump shows a SINGLE tcp session that lasted 900 seconds. What I don't like
about the
Flow data, is that the MX exports the "same" flow several times with the same
starting time, but
with increasing durations. I have on prupose changed all export times to be
something else than
60 seconds, but still the MX exports arround every 60 seconds.
The box is not busy, it is in a lab setup. Where there are only a few flows. So
I don't think
It is caused by a memory shortage. (It exports the flows before the interval
time to free memory)
As a tool to estimate traffic volumes this is not fatal,
but If you would like to look at rates like bps or pps you are out of luck.
Is this normal expected behavior ?
Is this beaviour according to standard ?
My sampling configuration is like this:
root@pe1-test> show configuration forwarding-options sampling | display set
relative
set sample-once
set instance sample-1 input rate 1
set instance sample-1 family inet output aggregate-export-interval 90
set instance sample-1 family inet output flow-inactive-timeout 180
set instance sample-1 family inet output flow-active-timeout 600
set instance sample-1 family inet output flow-server 10.20.126.2 port 9990
set instance sample-1 family inet output flow-server 10.20.126.2 version-ipfix
template ipv4
set instance sample-1 family inet output inline-jflow source-address
10.20.126.200
Kind Regards,
Peter Krupl
_______________________________________________
juniper-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/juniper-nsp
