- play_arrow Flow Capture Services
- play_arrow Dynamically Capturing Packet Flows Using Junos Capture Vision
- play_arrow Detecting Threats and Intercepting Flows Using Junos Flow-Tap and FlowTapLite Services
- Understanding the FlowTap and FlowTapLite Services
- Understanding FlowTap and FlowTapLite Architecture
- Configuring the FlowTap Service on MX Series Routers
- Configuring a FlowTap Interface on MX Series Routers
- Configuring FlowTap and FlowTapLite Security Properties
- FlowTap and FlowTapLite Application Restrictions
- Examples: Configuring the FlowTapLite Application on MX Series and ACX Series Routers
- Configuring FlowTapLite on MX Series Routers and M320 Routers with FPCs
-
- play_arrow Inline Monitoring Services and Inband Network Telemetry
- play_arrow Inline Monitoring Services
- play_arrow Flow-Based Telemetry
- play_arrow Inband Flow Analyzer 2.0
- play_arrow Juniper Resiliency Interface
-
- play_arrow Sampling and Discard Accounting Services
- play_arrow Sampling Data Using Traffic Sampling and Discard Accounting
- play_arrow Sampling Data Using Inline Sampling
- Understand Inline Active Flow Monitoring
- Configuring Inline Active Flow Monitoring Using Routers, Switches or NFX250
- Configuring Inline Active Flow Monitoring on MX80 and MX104 Routers
- Configuring Inline Active Flow Monitoring on PTX Series Routers
- Inline Active Flow Monitoring of MPLS-over-UDP Flows on PTX Series Routers
- Inline Active Flow Monitoring on IRB Interfaces
- Example: Configuring Inline Active Flow Monitoring on MX Series and T4000 Routers
- play_arrow Sampling Data Using Flow Aggregation
- Understanding Flow Aggregation
- Enabling Flow Aggregation
- Configuring Flow Aggregation on MX, M and T Series Routers and NFX250 to Use Version 5 or Version 8 cflowd
- Configuring Flow Aggregation on MX, M, vMX and T Series Routers and NFX250 to Use Version 9 Flow Templates
- Configuring Flow Aggregation on PTX Series Routers to Use Version 9 Flow Templates
- Configuring Inline Active Flow Monitoring to Use IPFIX Flow Templates on MX, vMX and T Series Routers, EX Series Switches, NFX Series Devices, and SRX Series Firewalls
- Configuring Flow Aggregation to Use IPFIX Flow Templates on PTX Series Routers
- Configuring Observation Domain ID and Source ID for Version 9 and IPFIX Flows
- Configuring Template ID and Options Template ID for Version 9 and IPFIX Flows
- Including Fragmentation Identifier and IPv6 Extension Header Elements in IPFIX Templates on MX Series Routers
- Directing Replicated Flows from M and T Series Routers to Multiple Flow Servers
- Logging cflowd Flows on M and T Series Routers Before Export
- Configuring Next-Hop Address Learning on MX Series and PTX Series Routers for Destinations Accessible Over Multiple Paths
-
- play_arrow Real-Time Performance Monitoring and Video Monitoring Services
- play_arrow Monitoring Traffic Using Real-Time Performance Monitoring and Two-Way Active Monitoring Protocol (TWAMP)
- Understanding Using Probes for Real-Time Performance Monitoring on M, T, ACX, MX, and PTX Series Routers, EX and QFX Switches
- Configuring RPM Probes on M, MX and T Series Routers and EX Series Switches
- Understanding Real-Time Performance Monitoring on EX and QFX Switches
- Real-Time Performance Monitoring for SRX Devices
- Configuring RPM Receiver Servers
- Limiting the Number of Concurrent RPM Probes on M, MX, T and PTX Routers and EX Series Switches
- Configuring RPM Timestamping on MX, M, T, and PTX Series Routers and EX Series Switches
- Configuring the Interface for RPM Timestamping for Client/Server on a Switch (EX Series)
- Analyzing Network Efficiency in IPv6 Networks on MX Series Routers Using RPM Probes
- Configuring BGP Neighbor Discovery Through RPM
- Examples: Configuring BGP Neighbor Discovery on SRX Series Firewalls and MX, M, T and PTX Series Routers With RPM
- Trace RPM Operations
- Examples: Configuring Real-Time Performance Monitoring on MX, M, T and PTX Series Routers
- Enabling RPM on MX, M and T Series Routers and SRX Firewalls for the Services SDK
- Understand Two-Way Active Measurement Protocol
- Configure TWAMP on ACX, MX, M, T, and PTX Series Routers, EX Series and QFX10000 Series Switches
- Example: Configuring TWAMP Client and Server on MX Series Routers
- Example: Configuring TWAMP Client and Server for SRX Series Firewalls
- Understanding TWAMP Auto-Restart
- Configuring TWAMP Client and TWAMP Server to Reconnect Automatically After TWAMP Server Unavailability
- play_arrow Managing License Server for Throughput Data Export
- play_arrow Testing the Performance of Network Devices Using RFC 2544-Based Benchmarking
- Understanding RFC 2544-Based Benchmarking Tests on MX Series Routers and SRX Series Firewalls
- Understanding RFC2544-Based Benchmarking Tests for E-LAN and E-Line Services on MX Series Routers
- Supported RFC 2544-Based Benchmarking Statements on MX Series Routers
- Configuring an RFC 2544-Based Benchmarking Test
- Enabling Support for RFC 2544-Based Benchmarking Tests on MX Series Routers
- Example: Configure an RFC 2544-Based Benchmarking Test on an MX104 Router for Layer 3 IPv4 Services
- Example: Configuring an RFC 2544-Based Benchmarking Test on an MX104 Router for UNI Direction of Ethernet Pseudowires
- Example: Configuring an RFC 2544-Based Benchmarking Test on an MX104 Router for NNI Direction of Ethernet Pseudowires
- Example: Configuring RFC2544-Based Benchmarking Tests on an MX104 Router for Layer 2 E-LAN Services in Bridge Domains
- Example: Configuring Benchmarking Tests to Measure SLA Parameters for E-LAN Services on an MX104 Router Using VPLS
- play_arrow Configuring RFC 2544-Based Benchmarking Tests on ACX Series
- RFC 2544-Based Benchmarking Tests for ACX Routers Overview
- Layer 2 and Layer 3 RFC 2544-Based Benchmarking Test Overview
- Configuring RFC 2544-Based Benchmarking Tests
- Configuring Ethernet Loopback for RFC 2544-Based Benchmarking Tests
- RFC 2544-Based Benchmarking Test States
- Example: Configure an RFC 2544-Based Benchmarking Test for Layer 3 IPv4 Services
- Example: Configuring an RFC 2544-Based Benchmarking Test for NNI Direction of Ethernet Pseudowires
- Example: Configuring an RFC 2544-Based Benchmarking Test for UNI Direction of Ethernet Pseudowires
- Configuring a Service Package to be Used in Conjunction with PTP
- play_arrow Tracking Streaming Media Traffic Using Inline Video Monitoring
- Understanding Inline Video Monitoring on MX Series Routers
- Configuring Inline Video Monitoring on MX Series Routers
- Inline Video Monitoring Syslog Messages on MX Series Routers
- Generation of SNMP Traps and Alarms for Inline Video Monitoring on MX Series Routers
- SNMP Traps for Inline Video Monitoring Statistics on MX Series Routers
- Processing SNMP GET Requests for MDI Metrics on MX Series Routers
-
- play_arrow Configuration Statements and Operational Commands
Example: Sampling and Discard Accounting Configuration on M, MX and T Series Routers
Discard accounting allows you to sample traffic, send it to a flow server for analysis,
and discard all packets without forwarding them to their intended destination. Discard
accounting is enabled with the discard accounting
group-name
statement in a firewall filter at the
[edit firewall family inet filter filter-name term
term-name then]
hierarchy level. Then, the filter is
applied to an interface with the filter
statement at the [edit
interfaces interface-name unit unit-number
family inet]
hierarchy level and processed with the output
statement at the [edit forwarding-options accounting
group-name]
hierarchy level.
In Figure 1, traffic from Router 1 arrives on the monitoring router’s Gigabit Ethernet ge-2/3/0 interface. The export interface leading to the flow server is fe-1/0/0 and there is no exit interface.
In this example, TCP traffic is sent to one accounting group and all other traffic is
diverted to a second group. After being sampled and counted, the two types of traffic
are acted upon by the sampling and accounting processes. These processes create flow
records and send the records to the version 8 flow server for analysis. Because multiple
types of traffic are sent to the same server, we recommend that you configure the
engine-id, engine-type, and
source-address
statements manually in your accounting and sampling
hierarchies. This way, you can differentiate between traffic types when they arrive at
the flow server.
[edit] interfaces { sp-2/0/0 { # This adaptive services interface creates the flow records. unit 0 { family inet { address 10.5.5.1/32 { destination 10.5.5.2; } } } } fe-1/0/0 { # This is the interface where records are sent to the flow server. unit 0 { family inet { address 10.60.2.2/30; } } } ge-2/3/0 { # This is the input interface where traffic enters the router. unit 0 { family inet { filter { input catch_all; } address 10.11.1.1/30; } } } } forwarding-options { sampling { # The router samples the traffic. input { rate 100; # One out of every 100 packets is sampled. } } family inet { output { # The sampling process creates and exports flow records. flow-server 10.60.2.1 { # You can configure a variety of settings. port 2055; version 8; aggregation { # Aggregation is unique to flow version 8. protocol-port; source-destination-prefix; } } aggregate-export-interval 90; flow-inactive-timeout 60; flow-active-timeout 60; interface sp-2/0/0 { # This statement enables PIC-based sampling. engine-id 5; # Engine statements are dynamic, but can be configured. engine-type 55; source-address 10.60.2.2; # You must configure this statement. } } } accounting counter1 { # This discard accounting process handles default traffic. output { # This process creates and exports flow records. flow-inactive-timeout 65; flow-active-timeout 65; flow-server 10.60.2.1 { # You can configure a variety of settings. port 2055; version 8; aggregation { # Aggregation is unique to version 8. protocol-port; source-destination-prefix; } } interface sp-2/0/0 { # This statement enables PIC-based discard accounting. engine-id 1; # Engine statements are dynamic, but can be configured. engine-type 11; source-address 10.60.2.3; # You must configure this statement. } } } accounting t2 { # The second discard accounting process handles the TCP traffic. output { # This process creates and exports flow records. aggregate-export-interval 90; flow-inactive-timeout 65; flow-active-timeout 65; flow-server 10.60.2.1 { # You can configure a variety of settings for the server. port 2055; version 8; aggregation { # Aggregation is unique to version 8. protocol-port; source-destination-prefix; } } interface sp-2/0/0 { # This statement enables PIC-based discard accounting. engine-id 2; # Engine statements are dynamic, but can be configured. engine-type 22; source-address 10.60.2.4;# You must configure this statement. } } } } firewall { family inet { filter catch_all { # Apply the firewall filter on the input interface. term t2 { # This places TCP traffic into one group for sampling and from { # discard accounting. protocol tcp; } then { count c2;# The count action counts traffic as it enters the router. sample; # The sample action sends the traffic to the sampling process. discard accounting t2; # The discard accounting discards traffic. } } term default { # Performs sampling and discard accounting on all other traffic. then { count counter; # The count action counts traffic as it enters the router. sample# The sample action sends the traffic to the sampling process. discard accounting counter1; # This activates discard accounting. } } } } }
Verifying Your Work
To verify that your configuration is correct, use the following commands on the monitoring station that is configured for active flow monitoring:
show services accounting aggregation
(for version 8 flows only)show services accounting errors
show services accounting (flow | flow-detail)
show services accounting memory
show services accounting packet-size-distribution
show services accounting status
show services accounting usage
The following shows the output of the show
commands used with the
configuration example:
user@host> show services accounting flow name t2 Service Accounting interface: sp-2/0/0, Local interface index: 468 Service name: t2 Flow information Flow packets: 56130820, Flow bytes: 3592372480 Flow packets 10-second rate: 13024, Flow bytes 10-second rate: 833573 Active flows: 600, Total flows: 600 Flows exported: 28848, Flows packets exported: 960 Flows inactive timed out: 0, Flows active timed out: 35400 user@host> show services accounting Service Name: (default sampling) counter1 t2 user@host> show services accounting aggregation protocol-port detail name t2 Service Accounting interface: sp-2/0/0, Local interface index: 468 Service name: t2 Protocol: 6, Source port: 20, Destination port: 20 Start time: 442794, End time: 6436260 Flow count: 1, Packet count: 4294693925, Byte count: 4277471552 user@host> show services accounting aggregation source-destination-prefix name t2 limit 10 order packets Service Accounting interface: sp-2/0/0, Local interface index: 542 Service name: t2 Source Destination Input SNMP Output SNMP Flow Packet Byte Prefix Prefix Index Index count count count 10.1.1.2/20 10.225.0.1/0 24 26 0 13 9650 10.1.1.2/20 10.143.80.1/0 24 26 0 13 10061 10.1.1.2/20 10.59.176.1/0 24 26 0 13 10426 10.1.1.2/20 10.5.32.1/0 24 26 0 13 12225 10.1.1.2/20 10.36.16.1/0 24 26 0 13 9116 10.1.1.2/20 10.1.96.1/0 24 26 0 12 11050 10.1.1.2/20 10.14.48.1/0 24 26 0 13 10812 10.1.1.2/20 10.31.192.1/0 24 26 0 13 11473 10.1.1.2/20 10.129.144.1/0 24 26 0 13 7647 10.1.1.2/20 10.188.160.1/0 24 26 0 13 10056 user@host> show services accounting aggregation source-destination-prefix name t2 extensive limit 3 Service Accounting interface: sp-2/0/0, Local interface index: 542 Service name: t2 Source address: 10.1.1.2, Source prefix length: 20 Destination address: 10.200.176.1, Destination prefix length: 0 Input SNMP interface index: 24, Output SNMP interface index: 26 Source-AS: 69, Destination-AS: 69 Start time: Fri Feb 21 14:16:57 2003, End time: Fri Feb 21 14:22:50 2003 Flow count: 0, Packet count: 6, Byte count: 5340 Source address: 10.1.1.2, Source prefix length: 20 Destination address: 10.243.160.1, Destination prefix length: 0 Input SNMP interface index: 24, Output SNMP interface index: 26 Source-AS: 69, Destination-AS: 69 Start time: Fri Feb 21 14:16:57 2003, End time: Fri Feb 21 14:22:50 2003 Flow count: 0, Packet count: 6, Byte count: 5490 Source address: 10.1.1.2, Source prefix length: 20 Destination address: 10.162.160.1, Destination prefix length: 0 Input SNMP interface index: 24, Output SNMP interface index: 26 Source-AS: 69, Destination-AS: 69 Start time: Fri Feb 21 14:16:57 2003, End time: Fri Feb 21 14:22:50 2003 Flow count: 0, Packet count: 6, Byte count: 4079