packet sampling flow export (was "Re: Juniper cflowd")

From: Dave Plonka (plonka@doit.wisc.edu)
Date: Sat Nov 11 2000 - 13:11:29 PST

  • Next message: Josef_Buchsteiner@hetnet.nl: "cflowd compilation error"

    On Fri, Nov 10, 2000 at 08:17:58AM -0600, Mark Borchers wrote:
    > According to a Juniper engineer, the records exported by
    > their routers are exactly the same a Cisco Netflow export
    > messages.
    >
    > You can control the rate at which traffic is sampled under
    > "forwarding-options sampling input family inet rate"

    This sounds like the equivalent of the IOS packet sampling on the Cisco
    GSR:

       ip route-cache flow sampled
       ip flow-sampling-mode packet-interval <value>

    In JUNOS, is it possible to configure it to sample every packet for
    version 5 flow export? (I may be able to experiment with FlowScan with
    flows from a Juniper M20 later this month...)

    Recent experimentation that a colleague has been doing with a GSR with
    OC48 POS interfaces, running 12.0(13.3)S, shows that the most frequent
    sampling rate he can select for the OC48 POS interface is 1 packet in
    10.

    I'm curious about all this because it will influence how we
    post-process the flow data w/cflowd and other tools.

    For instance, some of FlowScan's CampusIO report application detection
    expects to be seeing every packet in the flow records, so I may need to
    loosen up some of the rules in FlowScan if the flows are based on
    packet sampling. Also, the resulting graphs need to be scaled
    accordingly (and labeled as "estimates" based on sampling, so I
    probably need to introduce another RRD that stores the sampling rate.

    Anyone know if the current sampling rate (on the Cisco or Juniper) is
    available via SNMP?

    Thanks,
    Dave

    -- 
    plonka@doit.wisc.edu  http://net.doit.wisc.edu/~plonka  ARS:N9HZF  Madison, WI
    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Sat Nov 11 2000 - 14:07:48 PST