Collecting Traffic Sampling Output in the Cisco Systems NetFlow Services Export Version 9 Format
In Junos OS Release 8.3 and later, you can collect a record of sampled flows using the version 9 format as defined in RFC 3954, Cisco Systems NetFlow Services Export Version 9. Version 9 uses templates to collect a set of sampled flows and send the record to a specified host.
You configure the version 9 template used to collect a
record of sampled flows at the [edit services monitoring] hierarchy level. For more information, see the Junos OS Services Interfaces Library for Routing Devices and
the Monitoring, Sampling, and Collection
Services Interfaces User Guide.
To enable the collection of traffic flows using the version 9
format, include the version9 statement at the [edit
forwarding-options sampling family family-name output flow-server hostname] hierarchy
level:
[edit forwarding-options sampling family family-name output flow-server hostname] version9 { template template-name; }
template-name is the name of
the version 9 template configured at the [edit services
monitoring] hierarchy level.
You configure traffic sampling at the [edit forwarding-options
sampling input] hierarchy level. In Junos OS Release 8.3
and later, you can configure sampling for MPLS traffic as well as
IPv4 traffic. You can define a version 9 flow record template
suitable for IPv4 traffic, MPLS traffic, or a combination of the two.
In Junos OS Release 9.5 and later, you can sample packets from both
the inet and mpls protocol families at the same
time. In Junos OS Release 10.4 and later, you can configure sampling
for peer AS billing traffic for the inet and ipv6 protocols only. For more information about how to configure traffic
sampling, see Configuring Traffic Sampling.
The following restrictions apply to configuration of the version 9 format:
You can configure only one host to collect traffic flows using the version 9 format. Configure the host at the
[edit forwarding-options sampling family family-name output flow-server hostname]hierarchy level.You cannot specify both the version 9 format and cflowd versions 5 and 8 formats in the same configuration. For more information about how to configure flow monitoring using cflowd version 8, see Directing Traffic Sampling Output to a Server Running the cflowd Application.
Any values for flow-active-timeout and flow-inactive-timeout that you configure at the
[edit forwarding-options sampling output]hierarchy level are overridden by the values configured in the version 9 template.Version 9 does not support Routing Engine-based sampling. You cannot configure version 9 to send traffic sampling result to a file in the /var/tmp directory.
Example: Configuring Active Flow Monitoring Using Version 9
In this example, you enable active flow monitoring using version 9.
You specify a template mpls that you configure at the [edit services monitoring] hierarchy level. You also configure
the traffic family mpls to sample MPLS packets.
[edit forwarding-options]
sampling {
input {
rate 1;
run-length;
}
family inet {
output {
flow-server 10.60.2.1 { # The IP address and port of the host
port 2055; # that collects the sampled traffic flows.
source-address 3.3.3.1;
version9 {
template mpls; # Version 9 records are sent
} # using the template named mpls
}
}
}
}