North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

periodic patterns in juniper netflow exports

  • From: Fernando Silveira
  • Date: Thu Jan 03 05:03:12 2008
  • Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; bh=Qoz5GIIVLfOiQVV2XmOOu0Zx9CU36q9qg/mAa/5QRbE=; b=GDRl0qnJnv4DgTuN0uB9xmzGcM3JsN42NZsyilPYrs+P+CpHvhQyvMUEZdSaxmYj8OIxwPAHqoyqWkcOMew+X5uxs8J0aZAeowT9Oj4xyhOd9QB8Wj0XijGck00AeyvYSSY05GK1JJSgEGyMB848uHf8apKZHCjm4Gwp88dLoGI=
  • Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=kUriZ0GC+PC2r3HfdSmklWXzB3uWGC38rKiEjvu8SQRrgSDiAYmUeOa1n5CGLayDn5U12VmUhZ3AlhUARd2GucW8xTpVgoQLspoX+vVcvcP1aog2prMhLstuaEQOlR+cqUuE4KSwLJiLDsyU/DnEOBKZqUc1c3+UdeBUbU6OhpM=
hi there,

I'm analyzing NetFlow traces from Abilene (which uses Juniper, of
course) and I'm seeing a periodic pattern in the traces. I know about
the activity and inactivity timeouts that can be set in JunOS to
control flow exports, but in the data I'm analyzing it seems like
there is some kind of global clock that flushes the flow cache every
minute. I mean the router exports *all* flows which are active at the
end of a time bin of one minute. Because of this, the flow records
look like they are binned in 1 minute intervals.

By the way, I'm not talking about any manipulation done by the
collector. I'm really looking at the FIRST and LAST time stamps
contained in each flow record. Can anyone tell me if there is such a
timer in JunOS, i.e., flushing the flow cache every minute (or an
interval defined as a parameter)?

Thanks in advance and happy Hew Year!
Fernando Silveira