Skip to content

Latest commit

 

History

History
171 lines (152 loc) · 7.9 KB

flows.md

File metadata and controls

171 lines (152 loc) · 7.9 KB

IPFIX/NetFlow configuration template

This is currently specific to an mx204 with the nfdump toolkit.

chassis {
    fpc 0 {
        sampling-instance default;
        inline-services {
            flow-table-size {
                ipv4-flow-table-size 10;
                ipv6-flow-table-size 5;
            }
        }

    }
}

services {
    flow-monitoring {
        version-ipfix {
            template v4 {
                ipv4-template;
            }
            template v6 {
                ipv6-template;
            }
        }
    }
}

forwarding-options {
    sampling {
        sample-once;
        instance {
            default {
                input {
                    rate 100;
                }
                family inet {
                    output {
                        flow-server 192.0.2.1 {
                            port 9995;
                            version-ipfix {
                                template {
                                    v4;
                                }
                            }
                        }
                        inline-jflow {
                            source-address 198.51.100.1;
                        }
                    }
                }
                family inet6 {
                    output {
                        flow-server 192.0.2.1 {
                            port 9995;
                            version-ipfix {
                                template {
                                    v6;
                                }
                            }
                        }
                        inline-jflow {
                            source-address 198.51.100.1;
                        }
                    }
                }
            }
        }
    }
}

# measurement rules are good to add as the first in interface filter input-list
firewall {
    family inet {
        filter measurement-v4 {
        interface-specific;
            # ...
            term default {
                then {
                    count packets;
                    sample;
                    next term;
                }
            }
        # ...
    }
    family inet6 {
        filter measurement-v6 {
        interface-specific;
            #...
            term default {
                then {
                    count packets;
                    sample;
                    next term;
                }
            }
        # ...
    }
}

useful Junos commands

  • flow export statistics:
    show services accounting flow inline-jflow fpc-slot 0
  • flow export status:
    show services accounting status inline-jflow fpc-slot 0
  • flow export errors:
    show services accounting errors inline-jflow fpc-slot 0
  • clear flow state:
    clear services accounting flow inline-jflow fpc-slot 0
  • show routing engine CPU, memory, and related state:
    show chassis routing-engine
  • show FPC CPu, memory, and related state:
    show chassis fpc

See notes below for a deeper look at flow table sizing information and FPC detail.

References

Junos flow table and FPC detail

Juniper provided the followed additional technical information about the flow tables and FPC support.

Flow table size is defined in blocks of 256*1024 flows. The memory is calculated different. Sampling flows records are created and stored in hash tables stored in EDMEM and OMEM (Optional Memory):

  • OMEM is used to store JFLOW information
  • EDMEM is used as bucket memory (counters for the flows stored on OMEM)

OMEM is reserved for Hash Table (record memory). Size is 256MB. Hash table size define the maximum number of flows that might be recorded at any given time. For example, if you configure 15 blocks for IPv4, you will sample ~3.96 Mflows (256102415). We have two mutually exclusive modes of flow table sizing:

  1. Manually specify per family flow table size.
    1. Only one block is created with the sum of block sizes specified for all the families.
    2. Separate space reserved for each family
  2. New knob “chassis fpc inline-services flex-flow-sizing”
    1. 4M entries allocated to single flow table
    2. Flows are added on a first-come-first-served basis
    3. If flow table becomes full an error counter will be incremented
    4. No separate space reserved for any family

In the following image, you will see the difference between the mode of flow table sizing:

flow table size 1 flow table size 2