[j-nsp] flow sampling: what packets are chosen?

chris r. chricki at gmx.net
Tue Jul 23 14:16:13 EDT 2013


Hi guys,

I'm using Juniper hardware to sample traffic and dump it to NetFlow
data. In my config, the sampling rate is 1000, run-length is 0.

According to the docs [1], this means that 1 out of 1000 packets per
flow is sampled. Does this mean that *always* the first (1001st, 2001st,
3001st, ...) packet of a flow is included (as the figure in the docs
suggests) or is the sampling more random?

And if sampling is done more random: Can I miss flows due to packet
sampling, e.g., if flows have fewer than 1000 packets?

Thanks a lot for your help,
Chris

[1]:
http://www.juniper.net/techpubs/software/junos/junos94/swconfig-policy/configuring-traffic-sampling.html#id-11354799


More information about the juniper-nsp mailing list