Re: [pmacct-discussion] IPFIX template - tee plugin
Hi Catalin, We also do have junipers running which can't use multiple receivers. So we also are tee-ing it, and it's working great. Please keep in mind that the templates are only send each few minutes, so until you have received a template you could see a complaint, but after that it's working great. Met vriendelijke groet, www.puur-it.nl René Stoutjesdijk Wiekenweg 56H, 3815 KL Amersfoort Postbus 2931, 3800 GK Amersfoort t 033 4720 550 f 087 7844 022 m 065 1470 608 Disclaimer: De informatie in dit e-mailbericht is van vertrouwelijke aard en alleen bedoeld voor gebruik door de geadresseerde(n). Als u een bericht onbedoeld heeft ontvangen, wordt u verzocht de verzender hiervan in kennis te stellen en het bericht te vernietigen zonder van de inhoud kennis te nemen, deze te vermenigvuldigen of andersoortig te gebruiken. PUUR it is op geen enkele wijze aansprakelijk, voor eventuele schade die voortvloeit uit deze digitale verzending. -Oorspronkelijk bericht- Van: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] Namens Paolo Lucente Verzonden: dinsdag 30 mei 2017 12:04 Aan: pmacct-discussion@pmacct.net Onderwerp: Re: [pmacct-discussion] IPFIX template - tee plugin Hi Catalin, To briefly confirm you that, yes, NetFlow v9/IPFIX templates are tee'd as well to receivers. Maybe a touch of tshark/Wireshark can reveal if these templates are not sent from the J's themselves? For example: shell> tshark -d udp.port==,cflow -R cflow.template_id Should return you (or save to disk) only template packets for you to inspect. Maybe also good addition to troubleshooting documentation. Cheers, Paolo On Tue, May 30, 2017 at 10:09:44AM +0100, Catalin Petrescu wrote: > Hi list, > > Is the ipfix template forwarded when using tee plugins. > > I have couple of juniper devices sending ipfix to pmacctd and couple > of receivers complaining about missing templates. > The code i'm using on juniper dosn't allow multiple ipfix servers... > > Thx, > Catalin > ___ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
Re: [pmacct-discussion] IPFIX template - tee plugin
Thx Paolo. I can see the template packets replicated. Regards, Catalin On Tue, May 30, 2017 at 11:04 AM, Paolo Lucente wrote: > > Hi Catalin, > > To briefly confirm you that, yes, NetFlow v9/IPFIX templates are tee'd > as well to receivers. Maybe a touch of tshark/Wireshark can reveal if > these templates are not sent from the J's themselves? For example: > > shell> tshark -d udp.port==,cflow -R cflow.template_id > > Should return you (or save to disk) only template packets for you to > inspect. Maybe also good addition to troubleshooting documentation. > > Cheers, > Paolo > > On Tue, May 30, 2017 at 10:09:44AM +0100, Catalin Petrescu wrote: > > Hi list, > > > > Is the ipfix template forwarded when using tee plugins. > > > > I have couple of juniper devices sending ipfix to pmacctd and couple of > > receivers complaining about missing templates. > > The code i'm using on juniper dosn't allow multiple ipfix servers... > > > > Thx, > > Catalin > > > ___ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists > > > ___ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists > ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
Re: [pmacct-discussion] IPFIX template - tee plugin
Hi Catalin, To briefly confirm you that, yes, NetFlow v9/IPFIX templates are tee'd as well to receivers. Maybe a touch of tshark/Wireshark can reveal if these templates are not sent from the J's themselves? For example: shell> tshark -d udp.port==,cflow -R cflow.template_id Should return you (or save to disk) only template packets for you to inspect. Maybe also good addition to troubleshooting documentation. Cheers, Paolo On Tue, May 30, 2017 at 10:09:44AM +0100, Catalin Petrescu wrote: > Hi list, > > Is the ipfix template forwarded when using tee plugins. > > I have couple of juniper devices sending ipfix to pmacctd and couple of > receivers complaining about missing templates. > The code i'm using on juniper dosn't allow multiple ipfix servers... > > Thx, > Catalin > ___ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
