Juniper Tips 35: How to configure netflow on MX480

Configuring Flow Aggregation to Use Version 9 Flow Templates

Use of version 9 allows you to define a flow record template suitable for IPv4 traffic, IPv6 traffic, or peer AS billing traffic. Templates and the fields included in the template are transmitted to the collector periodically, and the collector need not be aware of the router configuration.

Example Router Configuration

The following output shows the configuration of an MX480 router with two sampling instances.

user@MX480–router> show configuration 
[...Output Truncated...]
}
chassis {
    fpc 0 { # The fpc number is associated with the interface on which sampling is enabled, ge-0/1/0 in this statement.
        sampling-instance s0;
    }
    fpc 3 { # The fpc number is associated with the interface on which sampling is enabled, ge-3/1/0 in this statement.
        sampling-instance s1;
    }
}

##if you did not configure, it will show error when commit
Service PIC or inline-jflow (j-series and SRX only) must be specified for version9
##
interfaces {
    ge-0/1/0 { # This interface has sampling activated.
        unit 0 {
            family inet {
                sampling { # Here sampling is activated.
                    input;
                }
                address 10.0.0.1/30;
            }
        }
    }
    ge-1/0/0 { # The interface on which packets are exiting the router.
        unit 0 {
            family inet {
                address 20.0.0.1/30;
            }
        }
    }
    ge-1/0/4 { # The interface connected to the cflowd server.
        unit 0 {
            family inet {
                address 2.2.2.1/32;
            }
        }
    }
    sp-2/0/0 { # The service interface that samples the packets from Router 1.it must be sp-4/0/0, can not use sp-4/0/1
        unit 0 {
            family inet;
        }
    }
    sp-2/1/0 { # The service interface that samples the packets from Router 3.
        unit 0 {
            family inet;
        }
    }
    ge-3/1/0 { # This interface has sampling activated.
        unit 0 {
            family inet {
                sampling { # Here sampling is activated.
                    input;
                }
                address 11.0.0.1/30;
            }
        }
    }
}
forwarding-options {
    sampling {
        instance {
            s0 {
                input {
                    rate 1;
                    run-length 0;
                }
                family inet {
                    output {
                        flow-server 2.2.2.2 { # The address of the external server.
                            port 2055;
                            version9 {
                                template {
                                    v4
                                }
                            }
                        }
                        interface sp-2/0/0 {
                            source-address 1.1.1.1; # Source address of the sampled packets
                        }
                    }
                }
            }
            s1 {
                input {
                    rate 1;
                    run-length 0;
                }
                family inet {
                    output {
                        flow-server 2.2.2.2 { # The address of the external server.
                            port 2055;
                            version9 {
                                template {
                                    v4
                                }
                            }
                        }
                        interface sp-2/1/0 {
                            source-address 1.1.1.2; # Source address of the sampled packets
                        }
                    }
                }
            }
        }
    }
}

routing-options {
    static {
        route 50.0.0.0/8 next-hop 20.0.0.2;
    }
}
services {
    flow-monitoring {
        version9 {
            template v4 {
                flow-active-timeout 30;
                flow-inactive-timeout 30;
                ipv4-template;
            }
        }
    }
}

Configuration Commands Used for the Configuration Example

The following set commands are used for the configuration of the sampling instance in this example. Replace the values in these commands with values relevant to your own network.

  • set chassis fpc 0 sampling-instance s0
  • set chassis fpc 3 sampling-instance s1
  • set interfaces ge-0/1/0 unit 0 family inet sampling input
  • set interfaces ge-0/1/0 unit 0 family inet address
  • set interfaces ge-1/0/0 unit 0 family inet address
  • set interfaces sp-2/0/0 unit 0 family inet
  • set interfaces sp-2/1/0 unit 0 family inet
  • set interfaces ge-3/1/0 unit 0 family inet sampling input
  • set interfaces ge-3/1/0 unit 0 family inet address
  • set forwarding-options sampling instance s0 input rate 1
  • set forwarding-options sampling instance s0 input run-length 0
  • set forwarding-options sampling instance s0 family inet output flow-server 2.2.2.2 port 2055
  • set forwarding-options sampling instance s0 family inet output flow-server 2.2.2.2 version9 template v4;
  • set forwarding-options sampling instance s0 family inet output interface sp-2/0/0 source-address 1.1.1.1
  • set forwarding-options sampling instance s1 input rate 1
  • set forwarding-options sampling instance s1 input run-length 0
  • set forwarding-options sampling instance s1 family inet output flow-server 2.2.2.2 port 2055
  • set forwarding-options sampling instance s1 family inet output flow-server 2.2.2.2 version9 template v4;
  • set forwarding-options sampling instance s1 family inet output interface sp-2/1/0 source-address 1.1.1.2
  • set routing-options static route 50.0.0.0/8 next-hop 20.0.0.2
  • set services flow-monitoring version9 template v4 flow-active-timeout 30
  • set services flow-monitoring version9 template v4 flow-inactive-timeout 30
  • set services flow-monitoring version9 template v4 ipv4-template

Verifying Your Work

To verify that your configuration is working as expected, use the following commands on the router that is configured with the sampling instance:

  • show services accounting aggregation template template-name template-name
  • show services accounting flow

The following shows the output of the show commands issued on the MX480 router used in this configuration example:

user@MX480–router> show services accounting aggregation template template-name v4
                                  Src   Dst
                                Port/ Port/
Source          Destination      ICMP  ICMP                          Packet
Address         Address          Type  Code  Proto TOS                Count
10.0.0.6        50.0.0.3          100  1000     17   8                   14
10.0.0.5        50.0.0.2          100  1000     17   8                   15
10.0.0.3        50.0.0.3          100  1000     17   8                   15
10.0.0.2        50.0.0.3          100  1000     17   8                   15
10.0.0.4        50.0.0.2          100  1000     17   8                   15
10.0.0.6        50.0.0.2          100  1000     17   8                   15
10.0.0.4        50.0.0.3          100  1000     17   8                   15
10.0.0.2        50.0.0.2          100  1000     17   8                   16
10.0.0.3        50.0.0.2          100  1000     17   8                   15
10.0.0.5        50.0.0.3          100  1000     17   8                   15

user@MX480–router> show services accounting aggregation template template-name v4
                                  Src   Dst
                                Port/ Port/
Source          Destination      ICMP  ICMP                          Packet
Address         Address          Type  Code  Proto TOS                Count
10.0.0.6        50.0.0.3          100  1000     17   8                   16
10.0.0.5        50.0.0.2          100  1000     17   8                   17
10.0.0.3        50.0.0.3          100  1000     17   8                   16
10.0.0.2        50.0.0.3          100  1000     17   8                   16
10.0.0.4        50.0.0.2          100  1000     17   8                   17
10.0.0.6        50.0.0.2          100  1000     17   8                   17
10.0.0.4        50.0.0.3          100  1000     17   8                   16
10.0.0.2        50.0.0.2          100  1000     17   8                   17
10.0.0.3        50.0.0.2          100  1000     17   8                   17
10.0.0.5        50.0.0.3          100  1000     17   8                   16

user@MX480–router> show services accounting flow
  Flow information
    Interface name: sp-2/0/0, Local interface index: 152
    Flow packets: 884, Flow bytes: 56576
    Flow packets 10-second rate: 0, Flow bytes 10-second rate: 628
    Active flows: 10, Total flows: 35
    Flows exported: 75, Flows packets exported: 14
    Flows inactive timed out: 25, Flows active timed out: 75

user@MX480–router> show services accounting flow
  Flow information
    Interface name: sp-2/0/0, Local interface index: 152
    Flow packets: 898, Flow bytes: 57472
    Flow packets 10-second rate: 0, Flow bytes 10-second rate: 628
    Active flows: 10, Total flows: 35
    Flows exported: 75, Flows packets exported: 14
    Flows inactive timed out: 25, Flows active timed out: 75

Juniper Tips 34: How to troubleshooting packets dropped under fpc level

1. login to the FC4.

re0> start shell pfe network fc4

2. Check firewall filter whether the counter will be increased.

re0-tty>#show jnh 0 exceptions terse

jnh( Display State of the forwarding layer)

Reason                             Type         Packets      Bytes

==================================================================

Firewall

———————-

firewall discard                   DISC(67)         573      47892 

Routing

———————-

control pkt punt via nh            PUNT(34)          30       3232

3. Check filter index

re0 vty)# sh filter

Program Filters:

—————

Index     Dir     Cnt    Text     Bss  Name

——–  ——  ——  ——  ——  ——–

Term Filters:

————

Index    Semantic   Name

——–  ———- ——

1  Classic    DDOSClean

2  Classic    DDOSCleanPM

3  Classic    __default_bpdu_filter__

4  Classic    l2-filter

17000  Classic    __default_arp_policer__

57008  Classic    __cfm_filter_shared_lc__

65024  Classic    __flowspec_default_inet__

65280  Classic    __auto_policer_template__

65281  Classic    __auto_policer_template_1__

65282  Classic    __auto_policer_template_2__

65283  Classic    __auto_policer_template_3__

65284  Classic    __auto_policer_template_4__

65285  Classic    __auto_policer_template_5__

65286  Classic    __auto_policer_template_6__

65287  Classic    __auto_policer_template_7__

—(more)—

65288  Classic    __auto_policer_template_8__

65536  Classic    PortMirror

16777216  Classic    fnp-filter-level-all

46137345  Classic    HOSTBOUND_IPv4_FILTER

46137346  Classic    HOSTBOUND_IPv6_FILTER

 

Resolve Filters:

—————

Index

——–

4. Verify whether the firewall filter implemented correctly

# sh filter index  65024 program

NPC4(re0vty)# sh filter index  65024 program

Filter index = 65024

Optimization flag: 0xf7

Filter notify host id = 0

Filter properties: None

Filter state = CONSISTENT

term *,*,proto=17,port=123

term priority 0

protocol

17

policer template flowspec_policer_rate_100000

policer 100M_*,*,proto=17,srcport=123

app_type 21

bandwidth-limit 100000000 bits/sec

burst-size-limit 62500 bytes

discard

count *,*,proto=17,srcport=123

term *,*,len=450,=65535

term priority 0

 

then

discard

count *,*,len=450,=65535

iphone Tips 5: delete all input and others

1、编写短信的时候,如果想把写的内容全删掉,只需晃动你的iPhone几下,会弹出个窗口,选择“撤销键入”就可把内容全删掉了,不用按着删除键半天。

如果想把刚删掉的内容恢复,晃动iPhone选择“重做键入”,刚删掉的内容就回来了;如果是刚粘贴过来的,晃动可以“撤销粘贴”。

2.大家有没有遇到这样的情况:想输入”度”(小圈圈)这个单位符号,可是找不到,现在告诉大家:在数字键盘上按住0不动,就会出现此符号!

3.计算器横过来是科学计算器(非常实用)

4.打字时输入两个空格可以輸入”.”

5. 有来电,按一下关机键静音,按两下拒接.

6.在充电之前打开飞行模式,你充电的速度会加快一倍,洗个澡喝个咖啡,手机就充满了.

7.出国的时候(或者在没有信号的地方),通过隐藏的离线地图功能,你可以把Google地图当免费的GPS导航用。使用方法是,将地图缩放到你想要离线的位置,然后在搜索框中敲入:ok maps,于是这个地区的离线数据就自动下载到你的手机里了.

8.在计算器界面上,你可以直接用手指向右滑动,删掉最后一个输入的数字,可以节省不少时间哦。


9. 在浏览网页的时候,单击屏幕上方的时间,可以回到网页顶部,再也不用大拇指“轰轰”地紧倒腾了。

Windows Tips 4: How to remove thumbs.db file

Thumbs.db is much like it’s name. It stores graphics, movie, and some document files then generates a preview of the folder contents using a thumbnail cache.
These folders are generated automatically  by Windows so that  folder content doesn’t need to be recalculated every time the folder is viewed.

Here’s how you can disable thumbs.db:

For Windows XP:

  • Open My Computer
  • Click on Tools
  • Click Folder Options
  • Click the View tab
  • Put a check in the box next to “Do not cache thumbnails”
  • Click on OK

You’re done. :) (you can close My Computer if you like)

For Windows Vista and Windows 7:

  • Click the Start button
  • Click on Control Panel
  • Click on Folder Options
  • Click on the View tab
  • Under the Files and Folders section check the button next to “Always show icons, never thumbnails”
  • Click on Apply
  • Click on OK

You may need to run Disk Cleanup  in Vista or Windows 7 to remove any thumbs.db files that have already been created. Here’s how:

  • Go to Start
  • Go to Accessories
  • Go to System Tools
  • Go to Disk Cleanup
  • In Disk Cleanup: Drive Selection make sure the (C:) drive is showing
  • Click OK (disk cleanup will run a brief calculation and then end)
  • On the Disk Cleanup Menu make sure there’s a check next to the Thumbnails entry.
  • Click OK, then on the Delete Files pop up – the files you selected will be cleaned, and you’re done.

Juniper Tips 33: Packet capture on line card and ttrace to find out command sequence

re1>start shell pfe network fpc 3 <-login the line card.

vty)#test jnh 0 packet-via-dmem dis

vty)#test jnh 0 packet-via dmem ena

vty)#test jnh 0 packet-via dmem capture

0×10 0×09 0×08 0xc0 0×02 0×00 0x1f 0×00
0×00 0×00 0×00 0×00 0×00 0×01 0×00 0×00
0×00 0×00 0×00 0×00 0×00 0×00 0x1f 0×00
0×10 0×00 0×00 0×00 0×10 0×00 0×21 0xc0
0×00 0×12 0xb0 0×00 0×20 0×04 0×40 0×20
0xc8 0×03 0×18 0×00 0×00 0xb6 0x5e 0×00
0×00 0xb6 0x5d 0×00 0×01 0×86 0xa0 0×00
0×01 0×86 0xa0 0×00 0×00 0×00 0×00 0×00
0×00 0×00 0×00 0×02 0×00 0×00 0×00 0×00
0×00 0×00 0×00 0×00 0×00 0×05 0×00 0×00
0×00 0×00 0×00 0×00 0×00 0×00 0×00 0×05
0×00 0×00 0×00 0×00 0×00 0×00 0×00 0×00
0×00 0×05 0×00 0×00 0×00 0×00 0×00 0×00

vty)#test jnh 0 packet-via dmem inject ttrac <-put the packet into ttrace to find out the command sequence.

Please paste hex dump of the packet, end with a dot (.)

….

20 pfe_alive_pkt_process_fabric_probe @ 0x657a
ASYNC XTXN COUNTER_FETCH_ADD(PA 0xc0000015, 0×00000001)
Reply64 is 0×0000000000015268
Prev_PC 0×6044 -> 0x657a
xra: 0×0000000000000400 -> 0×0000000000015268

21 entry_drop_out_no_count @ 0×0697
Prev_PC 0x657a -> 0×0697
WP0 0×0200 -> 0x0f00
IR0 0x047f008c -> 0×00000008

22 drop_out_check_svc_and_probe @ 0x02fa
Prev_PC 0×0697 -> 0x02fa
IR1 0xfffffc2f -> 0×00000000

23 drop_out_set_send_pkt_params @ 0x02fb
Prev_PC 0x02fa -> 0x02fb
WP0 0x0f00 -> 0x0ec0
LMEM[0x3b] 0×0000000000000482 -> 0x00bfe00008000000

24 entry_send_pkt @ 0x021b
Prev_PC 0x02fb -> 0x021b

vty)# show ttrace
Idx PFE ASIC PPE Ctx Zn Pending IDX/ Step/Total FLAG CURR_PC Label
0 0 0 5 8 2 30/ 29/ 1000 SAVE 0×0302 send_pkt_terminate_if_all_done

vty)# bringup ttrace 0 finish

vty)# bringup ttrace 0 delete

vty)# show ttrace
Idx PFE ASIC PPE Ctx Zn Pending IDX/ Step/Total FLAG CURR_PC Label