[j-nsp] periodic patterns in juniper netflow cache

[Fernando Silveira]

hi there,

I'm analyzing NetFlow traces from the Abilene Internet2 backbone
(which uses Juniper, of course) and I'm seeing a periodic pattern in
the traces. It seems like there is some kind of global clock that
flushes the flow
cache every minute. I mean the router exports *all* flows which are
active at the end of a time bin of one minute. Because of this, the
flow records look like they are binned in 1 minute intervals.

By the way, I'm not talking about any manipulation done by the
collector. Also note that I'm not talking about the activity timer, which is
supposed to be relative to the beginning of each flow. As fair as I know,
the activity timer exports a flow which has been active for too long. I'm
talking about the entire flow cache being flushed at a 1 minute global tick.

The patterns I'm talking about seem really specific to Juniper
routers. I have another set of traces (which I believe come from Cisco
routers) and they don't have the periodic flow export pattern I'm
referring here.

Can anyone tell me if there is such a
timer in JunOS, i.e., flushing the flow cache every minute (or an
interval defined as a parameter)?

Thanks in advance
Fernando Silveira

PS: I have two or three plots that show in detailed what I'm trying to
explain, but I'm not sure I can post them here. If anybody is interested
I could post it on the web and send the URL.