close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Flow Monitoring and Flow Collection Services
play_arrow Flow Capture Services
- play_arrow Dynamically Capturing Packet Flows Using Junos Capture Vision
- play_arrow Detecting Threats and Intercepting Flows Using Junos Flow-Tap and FlowTapLite Services
play_arrow Inline Monitoring Services and Inband Network Telemetry
- play_arrow Inline Monitoring Services
  - Inline Monitoring Services Configuration
- play_arrow Flow-Based Telemetry
  - Flow-Based Telemetry (EX4100, EX4100-F, and EX4400 Series)
  - Flow-Based Telemetry for VXLANs (QFX5120)
- play_arrow Inband Flow Analyzer 2.0
  - Inband Flow Analyzer (IFA) 2.0 Probe for Real-Time Flow Monitoring
- play_arrow Juniper Resiliency Interface
  - Juniper Resiliency Interface
play_arrow Sampling and Discard Accounting Services
play_arrow Real-Time Performance Monitoring and Video Monitoring Services
play_arrow Configuration Statements and Operational Commands
- Junos CLI Reference Overview

list Table of Contents

English

Example: Sampling Instance Configuration

date_range 01-Dec-23

arrow_backward

arrow_forward

You can configure active sampling using a sampling instance and associate that sampling instance to a particular Flexible Port Concentrator (FPC), Modular Port Concentrator (MPC), or Dense Port Concentrator (DPC). In addition, you can define multiple sampling instances associated with multiple destinations and protocol families per sampling instance destination.

Example Network Details

The following example shows the configuration of two sampling instances on an MX480 router running Junos OS Release 9.6.

Figure 1: Active Flow Monitoring—Sampling Instance Configuration Topology Diagram

In Figure 1, packets from Router 1 arrive on the monitoring router's Gigabit Ethernet ge-0/1/0 interface, the packets are sampled by the services interface sp-2/0/0 and sent to the cflowd server by the export interface ge-1/0/4. Packets from Router 3 arrive on the monitoring router’s Gigabit Ethernet ge-3/1/0 interface, the packets are sampled by the services interface sp-2/1/0 and sent to the cflowd server by the export interface ge-1/0/4. Normal traffic flow from ge-0/1/0 and ge-3/1/0 to ge-1/0/0 and on to Router 2 continues undisturbed during the sampling process. In active flow monitoring, both the input interface and exit interface can be any interface type (such as SONET/SDH, Gigabit Ethernet, and so on).

Only one sampling instance can be attached to an FPC, MPC, or DPC. Multiple families can be configured under a sampling instance. Each family can have its own collector address. You can define sampling instances and attach each instance to different FPCs, or a single sampling instance can be attached to all FPCs.

The sampling configuration for this example includes the following:

Two sampling instances, s0 and s1, configured to collect sampling data at the [edit forwarding-options] hierarchy level. The flow-server statement includes the IP address, port, and template of the flow server. The interface statement includes the services interface, sp-2/0/0 or sp-2/1/0, for flow record processing, and the source address of the incoming router on the sampled interface.
The binding of the two sampling instances to FPCs 0 and 3. These are configured with the sampling-instance statement at the [edit chassis fpc slot] hierarchy level.
Sampling activated on the input interfaces ge-0/1/0 and ge-3/1/0 using the sampling statement at the [edit interfaces interface-name unit unit-number family family] hierarchy level.

In this example, the ping command is issued on Router 1 to Router 2 via the MX480 router to generate traffic. After the packets are generated, show commands are issued to verify that the sampling configuration is working as expected.

Example Router Configuration

The following output shows the configuration of an MX480 router with two sampling instances.

content_copy zoom_out_map
user@MX480–router> show configuration 
[...Output Truncated...]
}
chassis {
    fpc 0 { # The fpc number is associated with the interface on which sampling is enabled, ge-0/1/0 in this statement.
        sampling-instance s0;
    }
    fpc 3 { # The fpc number is associated with the interface on which sampling is enabled, ge-3/1/0 in this statement.
        sampling-instance s1;
    }
}
interfaces {
    ge-0/1/0 { # This interface has sampling activated.
        unit 0 {
            family inet {
                sampling { # Here sampling is activated.
                    input;
                }
                address 10.0.0.1/30;
            }
        }
    }
    ge-1/0/0 { # The interface on which packets are exiting the router.
        unit 0 {
            family inet {
                address 192.0.2.1/30;
            }
        }
    }
    ge-1/0/4 { # The interface connected to the cflowd server.
        unit 0 {
            family inet {
                address 198.51.100.1/32;
            }
        }
    }
    sp-2/0/0 { # The service interface that samples the packets from Router 1.
        unit 0 {
            family inet;
        }
    }
    sp-2/1/0 { # The service interface that samples the packets from Router 3.
        unit 0 {
            family inet;
        }
    }
    ge-3/1/0 { # This interface has sampling activated.
        unit 0 {
            family inet {
                sampling { # Here sampling is activated.
                    input;
                }
                address 192.168.2.1/30;
            }
        }
    }
}
forwarding-options {
    sampling {
        instance {
            s0 {
                input {
                    rate 1;
                    run-length 0;
                }
                family inet {
                    output {
                        flow-server 198.51.100.2 { # The address of the external server.
                            port 2055;
                            version9 {
                                template {
                                    v4
                                }
                            }
                        }
                        interface sp-2/0/0 {
                            source-address 192.168.1.1; # Source address of the sampled packets
                        }
                    }
                }
            }
            s1 {
                input {
                    rate 1;
                    run-length 0;
                }
                family inet {
                    output {
                        flow-server 198.51.100.2 { # The address of the external server.
                            port 2055;
                            version9 {
                                template {
                                    v4
                                }
                            }
                        }
                        interface sp-2/1/0 {
                            source-address 192.168.1.2; # Source address of the sampled packets
                        }
                    }
                }
            }
        }
    }
}

routing-options {
    static {
        route 203.0.113.0/8 next-hop 192.0.2.2;
    }
}
services {
    flow-monitoring {
        version9 {
            template v4 {
                flow-active-timeout 30;
                flow-inactive-timeout 30;
                ipv4-template;
            }
        }
    }
}

Configuration Commands Used for the Configuration Example

The following set commands are used for the configuration of the sampling instance in this example. Replace the values in these commands with values relevant to your own network.

set chassis fpc 0 sampling-instance s0
set chassis fpc 3 sampling-instance s1
set interfaces ge-0/1/0 unit 0 family inet sampling input
set interfaces ge-0/1/0 unit 0 family inet address
set interfaces ge-1/0/0 unit 0 family inet address
set interfaces sp-2/0/0 unit 0 family inet
set interfaces sp-2/1/0 unit 0 family inet
set interfaces ge-3/1/0 unit 0 family inet sampling input
set interfaces ge-3/1/0 unit 0 family inet address
set forwarding-options sampling instance s0 input rate 1
set forwarding-options sampling instance s0 input run-length 0
set forwarding-options sampling instance s0 family inet output flow-server 198.51.100.2 port 2055
set forwarding-options sampling instance s0 family inet output flow-server 198.51.100.2 version9 template v4;
set forwarding-options sampling instance s0 family inet output interface sp-2/0/0 source-address 192.168.1.1
set forwarding-options sampling instance s1 input rate 1
set forwarding-options sampling instance s1 input run-length 0
set forwarding-options sampling instance s1 family inet output flow-server 198.51.100.2 port 2055
set forwarding-options sampling instance s1 family inet output flow-server 198.51.100.2 version9 template v4;
set forwarding-options sampling instance s1 family inet output interface sp-2/1/0 source-address 192.168.1.2
set routing-options static route 203.0.113.0/8 next-hop 192.0.2.2
set services flow-monitoring version9 template v4 flow-active-timeout 30
set services flow-monitoring version9 template v4 flow-inactive-timeout 30
set services flow-monitoring version9 template v4 ipv4-template

Verifying Your Work

To verify that your configuration is working as expected, use the following commands on the router that is configured with the sampling instance:

show services accounting aggregation template template-name template-name
show services accounting flow

The following shows the output of the show commands issued on the MX480 router used in this configuration example:

content_copy zoom_out_map
user@MX480–router> show services accounting aggregation template template-name v4
                                  Src   Dst
                                Port/ Port/
Source          Destination      ICMP  ICMP                          Packet
Address         Address          Type  Code  Proto TOS                Count
10.0.0.6        203.0.113.3       100  1000     17   8                   14
10.0.0.5        203.0.113.2       100  1000     17   8                   15
10.0.0.3        203.0.113.3       100  1000     17   8                   15
10.0.0.2        203.0.113.3       100  1000     17   8                   15
10.0.0.4        203.0.113.2       100  1000     17   8                   15
10.0.0.6        203.0.113.2       100  1000     17   8                   15
10.0.0.4        203.0.113.3       100  1000     17   8                   15
10.0.0.2        203.0.113.2       100  1000     17   8                   16
10.0.0.3        203.0.113.2       100  1000     17   8                   15
10.0.0.5        203.0.113.3       100  1000     17   8                   15

user@MX480–router> show services accounting aggregation template template-name v4
                                  Src   Dst
                                Port/ Port/
Source          Destination      ICMP  ICMP                          Packet
Address         Address          Type  Code  Proto TOS                Count
10.0.0.6        203.0.113.3      100  1000     17   8                   16
10.0.0.5        203.0.113.2      100  1000     17   8                   17
10.0.0.3        203.0.113.3      100  1000     17   8                   16
10.0.0.2        203.0.113.3      100  1000     17   8                   16
10.0.0.4        203.0.113.2      100  1000     17   8                   17
10.0.0.6        203.0.113.2      100  1000     17   8                   17
10.0.0.4        203.0.113.3      100  1000     17   8                   16
10.0.0.2        203.0.113.2      100  1000     17   8                   17
10.0.0.3        203.0.113.2      100  1000     17   8                   17
10.0.0.5        203.0.113.3      100  1000     17   8                   16

user@MX480–router> show services accounting flow
  Flow information
    Interface name: sp-2/0/0, Local interface index: 152
    Flow packets: 884, Flow bytes: 56576
    Flow packets 10-second rate: 0, Flow bytes 10-second rate: 628
    Active flows: 10, Total flows: 35
    Flows exported: 75, Flows packets exported: 14
    Flows inactive timed out: 25, Flows active timed out: 75

user@MX480–router> show services accounting flow
  Flow information
    Interface name: sp-2/0/0, Local interface index: 152
    Flow packets: 898, Flow bytes: 57472
    Flow packets 10-second rate: 0, Flow bytes 10-second rate: 628
    Active flows: 10, Total flows: 35
    Flows exported: 75, Flows packets exported: 14
    Flows inactive timed out: 25, Flows active timed out: 75

arrow_backward PREVIOUS Associating Sampling Instances for Active Flow Monitoring with a Specific FPC, MPC, or DPC

NEXT arrow_forward Example: Sampling and Discard Accounting Configuration on M, MX and T Series Routers

Monitoring, Sampling, and Collection Services Interfaces User Guide

ON THIS PAGE

Example: Sampling Instance Configuration

Example Network Details

Example Router Configuration

Configuration Commands Used for the Configuration Example

Verifying Your Work

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Monitoring, Sampling, and Collection Services Interfaces User Guide

ON THIS PAGE

Example: Sampling Instance Configuration

Example Network Details

Example Router Configuration

Configuration Commands Used for the Configuration Example

Verifying Your Work

Related Documentation

Stay in touch