Hi All, We are having trouble with the ntop NetFlow collector when receiving from Juniper MX80 routers using inline V10 (IPFIX) monitoring. I have attached a small packet dump which shows some examples of the flow data itself. When received by ntop (compiled from svn head) these show up as valid flows but are all discarded as "Flows with Bad Data". We also see a very strange number under Lost Flows.
Flow Senders
Sender Pkts Flows Lost Flows
10.202.0.82:33018 14 14 0
10.202.0.82:33073 1 1 4,294,967,295
Packets Received 358
Packets with Bad Version 0
Packets Processed 358
Valid Flows Received 278
Average Number of Flows per Packet 1.6
V1 Flows Received 0
V5 Flows Received 0
V7 Flows Received 0
V9 Data Flows Received 278
V9 Option Flows Received 0
Total V9 Templates Received 52
Discarded Flows
Flows with Zero Packet Count 0
Flows with Zero Byte Count 0
Flows with Bad Data 278
Flows with Unknown Template 0
Total Number of Flows Processed 0
The relavent parts of the configuration on the MX80s is as follows:
services {
flow-monitoring {
version-ipfix {
template ipv4 {
flow-active-timeout 60;
flow-inactive-timeout 70;
template-refresh-rate {
seconds 30;
}
option-refresh-rate {
seconds 30;
}
ipv4-template;
}
}
}
}
forwarding-options {
sampling {
instance {
sample-ins1 {
input {
rate 1;
}
family inet {
output {
flow-server 217.18.90.214 {
port 2055;
version-ipfix {
template {
ipv4;
}
}
}
inline-jflow {
source-address 10.202.0.82;
}
}
}
}
}
}
}
Please let me know if you need any further information,
Best regards,
Simon
Simon Talbot
Chief Engineer
Net Solutions Europe
T: 020 3161 6001
F: 020 3161 6011
www.nse.co.uk
The information contained in this e-mail and any attachments are private and
confidential and may be legally privileged. I am not authorised to bind Net
Solutions Europe Ltd contractually, nor to make representations or other
statements which may bind Net Solutions Europe Ltd in any way via electronic
means.
It is intended for the named addressee(s) only. If you are not the intended
recipient(s), you must not read, copy or use the information contained in any
way. If you receive this email or any attachments in error, please notify us
immediately by e-mail and destroy any copy you have of it.
We accept no responsibility for any loss or damages whatsoever arising in any
way from receipt or use of this e-mail or any attachments. This e-mail is not
intended to create legally binding commitments on our behalf, nor do its
comments reflect our corporate views or policies.
Net Solutions Europe Ltd Registered Office: 3 Acorn Business Centre,
Northarbour Road, Cosham, Portsmouth, Hampshire, PO6 3TH. Registered in England
No. 03203624.
packet.dmp
Description: packet.dmp
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
