[j-nsp] experiences with MX ipfix active and inactive flow timeouts at 15s or lower?

[Antti Ristimäki]

Hi,

----- On 28 Oct, 2022, at 18:14, Michael Hare via juniper-nsp juniper-nsp at puck.nether.net wrote:

> Anyone running with less than 30s ipfix active and inactive flow timeouts
> willing to share positive or negative experiences?  Our target platform is
> mx10003.
> 
> We've been running active 60 inactive 30 for quite some time and are looking to
> move closer to the known configuration floor of 10 for quicker flow based
> anomaly detection.  I've recently moved to a 30/30 stance.  I plot
> jnxOperatingCPU at 60s and couldn't see a change in the FPC graphs, which is
> where I think I'd expect to see a change if any?

More clueful people can correct me if I'm wrong, but as per my understanding the flow records are exported inline by the Trio and as such it shouldn't affect the LC CPU. And that is good.

Antti