[j-nsp] flow exports and next hops

[Josef Buchsteiner]

       This is actually the way we have implemented  it  as  we treat internal
       OSPF p2p interface  as  unnumbered  in  that case and therefor
       the next-hop  is 0.0.0.0. What you will have is the interface
       index which  should  be good enough for your application to understand
       where the flow was coming in. Below is an example.


Jun 10 13:49:27 v5 flow entry
Jun 10 13:49:27    Src addr: 12.8.8.8 
Jun 10 13:49:27    Dst addr: 12.1.1.1 
Jun 10 13:49:27    Nhop addr: 0.0.0.0 
Jun 10 13:49:27    Input interface: 17
Jun 10 13:49:27    Output interface: 0
Jun 10 13:49:27    Pkts in flow: 6
Jun 10 13:49:27    Bytes in flow: 420 
Jun 10 13:49:27    Start time of flow: 336827516 
Jun 10 13:49:27    End time of flow: 336877526 
Jun 10 13:49:27    Src port: 1158 
Jun 10 13:49:27    Dst port: 646 
Jun 10 13:49:27    TCP flags: 0x18 
Jun 10 13:49:27    IP proto num: 6 
Jun 10 13:49:27    TOS: 0xc0 
Jun 10 13:49:27    Src AS: 1
Jun 10 13:49:27    Dst AS: 1
Jun 10 13:49:27    Src netmask len: 32
Jun 10 13:49:27    Dst netmask len: 32



bla at bla# run show interfaces | match ifIndex | match 17
  Logical interface so-3/0/1.0 (Index 71) (SNMP ifIndex 17)        


Tuesday, June 10, 2003, 11:27:53 AM, you wrote:

> I'm trying to collect some stats using the flow exports feature of JunOS
> (5.5R2.3)
> but have come across a problem.

> The router is setting the 'next-hop' value in the flow packet to
> '0.0.0.0' for
> flows that are destined towards a nexthop at the other end of a
> point-to-point
> SONET link.

> A 'show route' seems to give some clues as to the culprit:

>> show route xxxx extensive 

> inet.0: 122127 destinations, 212622 routes (122123 active, 3 holddown, 1
> hidden)
> xxxx/32 (1 entry, 1 announced)
> TSI:
> KRT in-kernel xxxx/32 -> {so-0/0/0.0}
>         *OSPF   Preference: 10
>                 Next hop: via so-0/0/0.0, selected
>                 State: <Active Int>
>                 Local AS:  8737 
>                 Age: 6d 5:05:51         Metric: 4 
>                 Area: 0.0.0.0
>                 Task: OSPF
>                 Announcement bits (3): 0-KRT 4-Resolve inet.0 5-RT 
>                 AS path: I

> The next hop here only shows an interface rather than an IP address, so
> presumably
> this is why the flow packets have 0.0.0.0 set for the next-hop.

> Is there a way around this? My flow analysis software gets somewhat
> confused
> and not happy when given a zero-value next hop, and ideally i'd like to
> see
> either the remote ip address of the SONET link or the 'final' next-hop.

> Thanks.
> Ben

> _______________________________________________
> juniper-nsp mailing list juniper-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/juniper-nsp