[j-nsp] j4350 not reporting destination interface in netflow records

Anton Smith anton at huge.geek.nz
Fri Jul 13 11:47:15 EDT 2007


Hi,

I am having problems with missing destination interface index numbers. 
They are always set to 0. Source interface index numbers appear to be 
fine and correct.

My configuration is roughly as follows:

     ge-0/0/1 {
         speed 10m;
         link-mode full-duplex;
         gigether-options {
             no-auto-negotiation;
         }
         unit 0 {
             family inet {
                 no-redirects;
                 sampling {
                     input;
                     output;
                 }
                 address x.x.x.x/30;
             }
         }
     }

forwarding-options {
     sampling {
         input {
             family inet {
                 rate 20;
             }
         }
         output {
             file filename samples;
             cflowd y.y.y.y {
                 port 1500;
                 source-address z.z.z.z;
                 version 8;
                 aggregation {
                     source-destination-prefix;
                 }
             }
             flow-active-timeout 900;
         }
     }
}

However, when using local dump, all I get are records like this 
(regardless of the source interface, the dest interface is always 0 - 
although in this copy/paste I only show two records from the same source 
interface):

Jul 14 02:51:13 v8 flow entry
Jul 14 02:51:13    Num of flows: 1
Jul 14 02:51:13    Pkts in flow: 1
Jul 14 02:51:13    Bytes in flow: 91
Jul 14 02:51:13    Start time of flow: 2066780464
Jul 14 02:51:13    End time of flow: 2066780464
Jul 14 02:51:13 Src/Dst prefix aggregation
Jul 14 02:51:13    Src prefix x.x.x.x
Jul 14 02:51:13    Dst prefix y.y.y.y
Jul 14 02:51:13    Src Mask 0x0
Jul 14 02:51:13    Dst Mask 0x18
Jul 14 02:51:13    Src AS xxx
Jul 14 02:51:13    Dst AS xxxxx
Jul 14 02:51:13    Src Interface 43
Jul 14 02:51:13    Dst Interface 0
Jul 14 02:51:13 v8 flow entry
Jul 14 02:51:13    Num of flows: 1
Jul 14 02:51:13    Pkts in flow: 1
Jul 14 02:51:13    Bytes in flow: 126
Jul 14 02:51:13    Start time of flow: 2066740843
Jul 14 02:51:13    End time of flow: 2066740843
Jul 14 02:51:13 Src/Dst prefix aggregation
Jul 14 02:51:13    Src prefix x.x.x.x
Jul 14 02:51:13    Dst prefix y.y.y.y
Jul 14 02:51:13    Src Mask 0x0
Jul 14 02:51:13    Dst Mask 0x1b
Jul 14 02:51:13    Src AS xxx
Jul 14 02:51:13    Dst AS xxxxx
Jul 14 02:51:13    Src Interface 43
Jul 14 02:51:13    Dst Interface 0


On my flow capture machine, running flow-filter on output interfaces 
gives me nothing except for output interface '0', so the output 
interface information simply is not there.

I am wondering if the information will be included if I sample from a 
firewall filter rather than using the 'sample' directive on the 
interface, although I am yet to try this.

I also wonder what information is given to the sampling daemon from the 
forwarding daemon, is the sample packet given after the forwarding 
decision is made, or before? If before, then I can understand why it 
cannot note the output interface...

Any ideas?




More information about the juniper-nsp mailing list