[nsp] Netflow V8 aggregation+export on GSR

Jens Kuehlers kuehlers at schlund.net
Tue Jul 6 10:56:16 EDT 2004


Hi!

I'm doing export of sampled traffic via Netflow V8 aggregated all 5 minutes 
from our Juniper boxes. I do export sampled traffic via Netflow V5 on 
our GSRs (12012, IOS 12.0(25)S1), but want to change this to V8, 
which I heard should be possible with flow-aggregation.

I had no success though, all my tools don't accept the data sent by the
Cisco, in fact it seems to be empty packets. 

The config on the Juniper looks like this: 

forwarding-options {
    sampling {
        input {
            family inet {
                rate 1000;
                run-length 0;
            }
        }
        output {
            cflowd IP.IP.IP.IP {
                port 2055;
                version 8;
                autonomous-system-type peer;
                aggregation {
                    source-destination-prefix {
                        caida-compliant;
                    }
                }
            }       
        }           
    }               
}  

I put a filter on a interface which samples all packets.

I copied this to the Cisco like this:
ip route-cache flow sampled 
on the interface
and:
ip flow-export version 5 peer-as
ip flow-sampling-mode packet-interval 1000
ip flow-aggregation cache as
 cache timeout active 5
 export destination IP.IP.IP.IP 2055
 enabled
ip flow-aggregation cache as
 cache timeout active 5
 export destination IP.IP.IP.IP 2055
 enabled

But this is not exporting valid data (at least I can't see it with my
utils). Am I missing anything?

Jens

-- 
Jens Kühlers
Schlund + Partner AG            Mail: kuehlers at schlund.net
Brauerstr. 48                   Tel:  0721/91374-0
76135 Karlsruhe                 Fax:  0721/91374-212


More information about the cisco-nsp mailing list