Hi,
I don't think it's the problem of different engine type. I captured some V8 data
from Cisco and Juniper routers using netxray, the engine ID and the engine type is
same. But the other fields are different.The data I using is as follows:
Table B-7 Cisco Netflow Version 8 Header Format
Bytes Contents Description
0每1 version 00 08 NetFlow export format version number
2每3 count 00 01 Number of flows exported in this flow frame
(protocol data unit, or PDU)
4每7 SysUptime 10 b5 bd fc Current time in milliseconds since the export
device booted
8每11 unix_secs 2b 95 99 1a Current seconds since 0000 UTC 1970
12每15 unix_nsecs05 48 e8 ae Residual nanoseconds since 0000 UTC 1970
16每19 flowSequence00 00 00 03 Sequence counter of total flows seen
20 engine_type 00 Type of flow switching engine
21 engine_id 00 ID number of the flow switching engine
22 aggregation 01 Aggregation method being used
23 agg_version 02 Version of the aggregation export
24每27 reserved 00 00 00 00 Unused (zero) bytes
Table B-8 Version 8 RouterAS Flow Record Format
Bytes Contents Description
0每3 flows 00 00 00 0d Number of flows
4每7 dPkts 00 00 03 71 Packets in the flow
8每11 dOctets 00 00 8f 3e Total number of Layer 3 bytes in the packets of
the flow
12每15 First 10 af d0 c8 SysUptime,in seconds, at start of flow
16每19 Last 10 b5 47 74 SysUptime, in seconds, at the time the last
packet of the flow was received
20每21 src_as 00 00 Source autonomous system number, either origin
or peer
22每23 dst_as 00 00 Destination autonomous system number, ither
origin or peer
24每25 input 00 01 SNMP index of input interface;
26每27 output 00 00 SNMP index of output interface
Table B-9 Juniper Netflow Version 8 Header Format
Bytes Contents Description
0每1 version 00 08 NetFlow export format version number
2每3 count 00 01 Number of flows exported in this flow frame
(protocol data unit, or PDU)
4每7 SysUptime 00 05 5b 9d Current time in milliseconds since the export
device booted
8每11 unix_secs 3b c6 af b5 Current seconds since 0000 UTC 1970
12每15 unix_nsecs 00 00 00 00 Residual nanoseconds since 0000 UTC 1970
16每19 flowSequence 00 00 1f 01 Sequence counter of total flows seen
20 engine_type 00 Type of flow switching engine
21 engine_id 00 ID number of the flow switching engine
22 aggregation 01 Aggregation method being used
23 agg_version 00 Version of the aggregation export
24每27 reserved 00 00 00 00 Unused (zero) bytes
Table B-10 Juniper Version 8 RouterAS Flow Record Format
Bytes Contents Description
0每3 flows 00 00 00 01 Number of flows
4每7 dPkts 00 00 e6 57 Packets in the flow
8每11 dOctets 00 39 95 c0 Total number of Layer 3 bytes in the packets of
the flow
12每15 First 00 05 5b 9e SysUptime,in seconds, at start of flow
16每19 Last 00 05 5b d8 SysUptime, in seconds, at the time the last
packet of the flow was received
20每21 src_as 00 0a Source autonomous system number, either origin
or peer
22每23 dst_as 00 0a Destination autonomous system number, either
origin or peer
24每25 input 00 18 SNMP index of input interface;
26每27 output 00 19 SNMP index of output interface
---- H.Y Zhang Oct.29 2001 -------->Hi Huiy, > >The error message indicates different engine type is expected by > >the Netflow collector. FYI, we are not supporting Netflow collector even > >thoughour cflowd implementation has functioned well with previous versions > >of Netflow. > >Since you are using a newer version of Netflow and we don't have > >Cisco's new design specification, we cannot anticipate and react to the > >Netflow version every time that Cisco puts out a new release. > >I think that you may want to request that Cisco modify their software > >to accept different engine types. I believe they are rejecting the Juniper > >records because they do not come from a Cisco router. > >I would recommend that you search on the cisco web site > >and find out additional information about the following fields. > >20 engine_type Type of flow switching engine > >21 engine_id ID number of the flow switching engine > >22 aggregation Aggregation method being used > >23 agg_version Version of the aggregation export > >Find out what the acceptable values are. > >Also, have you considered using a publically available and open > >version of cflowd collector? This will likely help you avoid these > >types of problems in the future. > >Finally, you can request an enhancement to the Junos code > >to allow you to configure the engine-type. However, this request > >should be made through your local Juniper Sales Team. > >Do you know who your local Juniper Systems Engineer is? > >Thanks, > >Bob O'Hara > > > > >-----Original Message----- >From: huiy [mailto:huiy@263.net] >Sent: Tuesday, October 23, 2001 9:42 PM >To: cisco-nsp@puck.nether.net >Subject: [j-nsp] =?gb2312?B?SG93IHRvIHVzZSBuZXRmbG93Q29sbGVjdG9yIHRvIGNvbGxlY3QgVjggZGF0YSBmcm9tIEp1 > > >Hello,everyone. >I'd like to use Netflow Collector3.0(2.0) to collect RouterAS information >from Juniper routers. >The Version 8 Header Format Cisco is using is as follows: > >0每1 version NetFlow export format version number >2每3 count Number of flows exported in this flow frame >4每7 SysUptime Current time in milliseconds since the export device booted >8每11 unix_secs Current seconds since 0000 UTC 1970 >12每15 unix_nsecs Residual nanoseconds since 0000 UTC 1970 >16每19 flow_sequence Sequence counter of total flows seen >20 engine_type Type of flow switching engine >21 engine_id ID number of the flow switching engine >22 aggregation Aggregation method being used >23 agg_version Version of the aggregation export >24每27 reserved Unused (zero) bytes > >Cisco set agg_version to 2 now,but Juniper set agg_version to 0. >And the other field is the same.When Netflow Collector 3.0 receive >V8 data from Juniper rou! ters,it says "error engine_type" and discard >the data. Anyone knows how to solve this problem? >Thanks a lot! > >--- >H.Y Zhang. >Oct.24 2001 > > > > > > > > > > >
This archive was generated by hypermail 2b29 : Sun Aug 04 2002 - 04:13:21 EDT