[j-nsp] Inline jflow AS Lookup Failures

[Drew Weaver]

How much of a disaster (vs 11.4) are we guessing that 12.3R3 is going to be?

From: Richard Hesse [mailto:richard.hesse at weebly.com]
Sent: Friday, June 28, 2013 2:58 PM
To: Drew Weaver
Cc: juniper-nsp at puck.nether.net
Subject: Re: [j-nsp] Inline jflow AS Lookup Failures

It's fixed in JunOS 12.3R3 and 13.2R1. It's in PR#820988, but that isn't ready for the public yet.

-richard

On Fri, Jun 28, 2013 at 5:08 PM, Richard Hesse <richard.hesse at weebly.com<mailto:richard.hesse at weebly.com>> wrote:
It's totally useless right now. I have a support case open with Juniper on this. I'll post back to the list if we make any headway.

-richard

On Fri, Jun 28, 2013 at 9:51 AM, Drew Weaver <drew.weaver at thenap.com<mailto:drew.weaver at thenap.com>> wrote:
Howdy,

I am wondering if anyone has figured out any way to get inline jflow to send proper dstas/srcas on routers with full tables?

I'm seeing a lot of these incrementing (snipped output):

show services accounting errors inline-jflow
    Route Record Lookup Failures: 5415, AS Lookup Failures: 15775477
show services accounting errors inline-jflow
    Route Record Lookup Failures: 5415, AS Lookup Failures: 15776293
What this ends up doing in practice is sending ff ff ff ff (or 4294967295) for the ASN..

Which ends up looking like:

[root at d6 etc]# /usr/local/bin/nfdump -r /var/netflow/nc/nfcapd.current -s dstas/bytes 'router ip 192.168.25.7 and out if 555' -qN
2013-06-27 22:23:02.827 52026.907 any          4294967295      996(20.3)     2201(14.9)   420620(17.1)        0       64   191

In other words, totally useless.

Any tips?
_______________________________________________
juniper-nsp mailing list juniper-nsp at puck.nether.net<mailto:juniper-nsp at puck.nether.net>
https://puck.nether.net/mailman/listinfo/juniper-nsp