[j-nsp] JFlow / IPFIX / Mac Addresses, IX Fabrics

[Daniel Rohan]

You can also do v9, but that comes with a load of restrictions. Better to
do ipfix IMO. L2 info is only grabbed off of L2 interfaces if I remember
correctly.

Dan

https://www.juniper.net/documentation/en_US/junos/topics/concept/inline-sampling-overview.html




On Fri, Dec 29, 2017 at 1:01 PM John Brown <john at citylinkfiber.com> wrote:

> Hello all you wonderful JUNOS geeks :)
> Happy New Year!
>
> Couple of quick questions:
>
> Current platform
> MX480
> RE-1800x4
> MPC3-3D
> MPC2-3D
> 1Gig and 10Gig MIC's
> SCBE
>
> Wanting to get flow data for both IPv4 and IPv6. Seems I need IPFIX
> for this????
>
> I'm also trying to get MAC addresses into my flows so that I can sort out
> which peer at a shared IX fabric (Think Equinix IBX, or LINX) is sending me
> packets of love.
>
> I'm ingesting into ELK and similar OS tools.
> Would like to do 1:1 for good resolution.
> The data is for security, forensics, historical, troubleshooting, back
> tracing DDOS, etc.
>
> Any tips / suggestions / sample configs would be greatly appreciated.
>
> Thanks..
> _______________________________________________
> juniper-nsp mailing list juniper-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/juniper-nsp
>
-- 
Thanks, Dan