North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: periodic patterns in juniper netflow exports

  • From: Roland Dobbins
  • Date: Thu Jan 03 05:44:28 2008
  • Authentication-results: hkg-dkim-1; [email protected]; dkim=pass ( sig from cisco.com/hkgdkim1002 verified; );
  • Dkim-signature: v=1; a=rsa-sha256; q=dns/txt; l=1241; t=1199356967; x=1200220967; c=relaxed/simple; s=hkgdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; [email protected]; z=From:=20Roland=20Dobbins=20<[email protected]> |Subject:=20Re=3A=20periodic=20patterns=20in=20juniper=20ne tflow=20exports |Sender:=20; bh=WJYcmgVgM2WHZAvQe4K4gOcE796ocleZwDASq+3ccKU=; b=NzsY8Kb5L/N5/+eI8xoRiTrDmRWHv6fCSyYCEjkNpB1p2TY7Gcuz/XepXF NCis4i60aqHzug3BUV6Ywf6rZuQ2ve7NiuXiKRIvniK45yxcmCpDfxg74Rhe OKqDR2j/Z0EU6fMg9WEc0Yz5Mrvt+OBUcHFsrf4hfZb+ONNyjZuQk=;



On Jan 3, 2008, at 5:57 PM, Fernando Silveira wrote:

 Can anyone tell me if there is such a
timer in JunOS, i.e., flushing the flow cache every minute (or an
interval defined as a parameter)?

I don't know about Juniper routers, but there's such a setting in Cisco routers, it's called the active flow timer. If you don't use it and don't tell your collection/analysis system what setting you've used (most folks use between 5 minutes for traffic analysis down to one minute for security-related analysis), you end up with backlogged stats which aren't chronologically representative of the actual traffic, and your graphs are all jagged and useless.


My guess would be that Juniper have a similar construct for a similar purpose. Most collection/analysis systems of which I'm aware take this setting into account, as long as you tell them what interval you're using. It's generally considered highly desirable to make use of this functionality, for the aforementioned reasons.

-----------------------------------------------------------------------
Roland Dobbins <[email protected]> // 408.527.6376 voice

Culture eats strategy for breakfast.

-- Ford Motor Company