AW: [j-nsp] j-flow question

[Steinar Torsvik]

Hi,

martin schneidhofer wrote:

> what is the technical difference in using
> a ASP on junipers. are there limitations 
> in the sampling of traffic without ASP ?

I have no experience with ASP, but Juniper (at least the M series I have 
worked with) has a limit of 7000pps for its sampled flows. You must 
remember to tell the software analyzing the flows you are running at a 
ratio of 1/100 as in the previous configuration example.

You can calculate the best ratio number for you by finding an average 
packet size for your network and match it up with the total network 
traffic. Remember to put in some overhead to handle unexpected 
situations. Go get your calculator :-)

We are using this software collection to analyze our flowdata. 
http://www.dynamicnetworks.us/netflow/ Here you can define the sample 
rate in the CUFlow.cf file with: SampleRate router-ip sample-rate

I dont know your hardware or load, but on an old M40 I have had problems 
that the router didnt have enough balls to export the flowdata. In loads 
of about 300mbit/s and about 80kpps the flow-exporting daemon on the 
Juniper ate all the cpu available to the system. This could also have 
happened because I am stupid and non-experienced working with this 
router :-)

Today we are running this on a M7i with about 80mbit/s load and 20kpps 
without problems. Our configuration is almost exactly the same as in the 
previous configuration example.

-- 
Regards,

Steinar Torsvik
Fasthost AS
Tlf: +47 22 00 88 50
Mob: +47 99 02 99 88