[j-nsp] No export from cflowd enabled POS interface

[Erik Haagsman]

Any reason you're sampling both ingress as well as egress instead of
just ingress on "opposing" interfaces...? Are the two interfaces you're
not seeing traffic on the inverse of the two interfaces you are seeing
traffic on (meaning ingress traffic on one flows to egress traffic on
the other)..?



On Thu, 2005-09-22 at 15:12 +0800, Joe Shen wrote:
> My configuration:
> 
> The four PoS interfaces(so-0/0/0.0, so-0/1/0.0,
> so-1/0/0.0,so-2/0/0.0 so-3/0/0.0) are configured like:
> 
> 
>       so-3/0/0 {
>         description "to backbone";
>         encapsulation cisco-hdlc;
>         sonet-options {
>             fcs 32;
>             payload-scrambler;
>         }
>         unit 0 {
>             family inet {
>                 filter {
>                     input netflow;
>                     output netflow;
>                 }
>                 address 10.10.41.251/30;
>             }
>             family iso;
>         }
>     }
> 
> Forward option is :
> 
> forwarding-options {
>     sampling {
>         input {
>             family inet {
>                 rate 5800;
>             }
>         }
>         output {
>             cflowd 10.96.13.46 {
>                 port 9900;
>                 version 5;
>             }
>         }
>     }
> }
> 
> Filter is configured as:
> 
> firewall {
> 
>     filter netflow {
>         term 1 {
>             then {
>                 sample;
>                 accept;
>             }       
>         }
>     }
> }
> 
> But, I can't see netflow export data on interface
> so-0/1/0.0 and so-2/0/0.0.
> 
> regards
> 
> joe
> 
> 
> 
> --- "Rafal Szarecki (WA/EPO)"
> <rafal.szarecki at ericsson.com>写道:
> 
> > You not provied config, so hard to say.
> > 
> > Where you call for samplin? In filter of on
> > interface level?
> > What is applied filters?
> > What direction?
> > 
> > If juyr J-Flow is done base on RE (not
> > AS-PIC/PM-PIC) then JUNOS intriduce limitation for
> > number of samples delivered to RE per second.
> > (default 1000 if I remember correctly) so it is also
> > possible that you loose some information from
> > problematic interfaces. However I do not expect,
> > espetialy if traffic volume of interfaces is at same
> > level)
> > 
> > Rafal Szarecki JNCIE
> > 
> > skype me <callto://Rafal_Szarecki/> 
> > 
> > 
> > 
> > > -----Original Message-----
> > > From: juniper-nsp-bounces at puck.nether.net 
> > > [mailto:juniper-nsp-bounces at puck.nether.net]On
> > Behalf Of Joe Shen
> > > Sent: Thursday, September 22, 2005 4:39 AM
> > > To: juniper-nsp at puck.nether.net
> > > Subject: [j-nsp] No export from cflowd enabled POS
> > interface
> > > 
> > > 
> > > Hi,
> > > 
> > > I'm trying to collect Cflowd export information on
> > our
> > > core router. After setting up cflowd I applied it
> > to 4
> > > POS ports. 
> > > 
> > > But, I noticed there is only netflow traffic
> > records
> > > on two of four ports when I analyze those data
> > got.
> > > The interface configuration is the same on the
> > four
> > > ports besides IP address. 
> > > 
> > > Why?
> > > 
> > > thanks
> > > 
> > > Joe
> > > 
> > > 
> > > 	
> > > 
> > > 	
> > > 		
> > >
> >
> ___________________________________________________________
> > 
> > > 雅虎免费G邮箱－中国第一绝无垃圾邮件骚扰超大邮箱 
> > > http://cn.mail.yahoo.com
> > > 
> > > _______________________________________________
> > > juniper-nsp mailing list
> > juniper-nsp at puck.nether.net
> > >
> > http://puck.nether.net/mailman/listinfo/juniper-nsp
> > > 
> > 
> 
> 
> 
> 	
> 
> 	
> 		
> ___________________________________________________________ 
> 雅虎免费G邮箱－中国第一绝无垃圾邮件骚扰超大邮箱 
> http://cn.mail.yahoo.com
> 
> _______________________________________________
> juniper-nsp mailing list juniper-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/juniper-nsp
-- 
---
Erik Haagsman
Network Architect
We Dare BV
Tel: +31(0)10-7507008
Fax: +31(0)10-7507005
http://www.we-dare.nl