Thanks for the response. Juniper docs are mixed about this (as usual). I
thought at first it might be this:
http://www.gossamer-threads.com/lists/nsp/juniper/42141
We're basically seeing extremely low bps/pps
There is another appliance inline that receives the flows, and replicates
them to the nfdump box. The other appliance seems fine.
Are we doing anything off base config wise for MS-MPC and templates? We
switched to 1:500 too. Still the same issue on nfdump.
I"ll probalby have to packet capture everything.
set services flow-monitoring version9 template template1
flow-active-timeout 120
set services flow-monitoring version9 template template1
flow-inactive-timeout 60
set services flow-monitoring version9 template template1
template-refresh-rate packets 480000
set services flow-monitoring version9 template template1
template-refresh-rate seconds 600
set services flow-monitoring version9 template template1
option-refresh-rate packets 480000
set services flow-monitoring version9 template template1
option-refresh-rate seconds 600
set services flow-monitoring version9 template template1 ipv4-template
set services service-set ss1 jflow-rules sampling
set services service-set ss1 sampling-service service-interface ms-5/0/0.0
set forwarding-options sampling input rate 500
set forwarding-options sampling input max-packets-per-second 65535
set forwarding-options sampling family inet output flow-server x.x.x.x port
9990
set forwarding-options sampling family inet output flow-server x.x.x.x
no-local-dump
set forwarding-options sampling family inet output flow-server x.x.x.x
version9 template template1
set forwarding-options sampling family inet output interface ms-5/0/0.0
source-address x.x.x.x
Thanks for Everyones input
On Thu, Jul 9, 2015 at 8:49 AM, Michael Hare <michael.h...@wisc.edu> wrote:
> With MS-MPC and TRIO, when an active flow is timed out the JunOS exporter
> [v9 or ipfix] holds onto the original start time. The hardware -is
> supposed to- blank the octets/packets counters.
>
> Now, I've had a case open for several weeks with an MX2010/MPC4/12.3R8
> where occasionally i'm getting phantom flows exported [mostly proto ESP]
> with errantly large octet/packet counters, but that's another story.
>
> We use 1:256
>
> -Michael
>
> > -----Original Message-----
> > From: sth...@nethelp.no [mailto:sth...@nethelp.no]
> > Sent: Thursday, July 09, 2015 4:21 AM
> > To: networkcontr...@gmail.com
> > Cc: nfdump-discuss@lists.sourceforge.net
> > Subject: Re: [Nfdump-discuss] Juniper MX MS-MPC / DPC V9 Netflow
> > pps/bps low?
> >
> > > Nfdump has been working fantastically for us until we upgraded to 1:1
> with
> > > an MS-MPC. It appears the MS-MPC on MX routers only support V9, and
> > they
> > > don't support aggregation.
> > >
> > > Everything was fine with Verison 5 Route Engine sampling. Now, at full
> > > blown 1:1 sampling via MS-MPC, everything is way off. It starts out
> ok but
> > > quickly gets out of sync after a few minutes. I read an earlier thread
> > > about this being the way Juniper exports flows but doesn't remove them
> > from
> > > the table.
> > >
> > > Is this only a version 9 thing? Is there something I can do to
> timers? It
> > > seems silly to get the ms-mpc only to get locked out of reliable
> reports
> > > due to the way v9 on Junos is exported. Does anyone have any
> experience
> > > with this?
> >
> > We use inline IPfix on Juniper Trio cards (MPC-3D-16XGE-SFPP, MX-MPC2-3D
> > etc) with 1:100 sampling. No MS-MPC. Seems to work for us. We never
> > needed or wanted 1:1.
> >
> > Steinar Haug, AS 2116
> >
> >
> ------------------------------------------------------------------------------
> > Don't Limit Your Business. Reach for the Cloud.
> > GigeNET's Cloud Solutions provide you with the tools and support that
> > you need to offload your IT needs and focus on growing your business.
> > Configured For All Businesses. Start Your Cloud Today.
> > https://www.gigenetcloud.com/
> > _______________________________________________
> > Nfdump-discuss mailing list
> > Nfdump-discuss@lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
>
------------------------------------------------------------------------------
Don't Limit Your Business. Reach for the Cloud.
GigeNET's Cloud Solutions provide you with the tools and support that
you need to offload your IT needs and focus on growing your business.
Configured For All Businesses. Start Your Cloud Today.
https://www.gigenetcloud.com/
_______________________________________________
Nfdump-discuss mailing list
Nfdump-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
