Routing

Hi All,

I have a qustion with regard to the difference between Jflow/Netflow v5 and v10.

I already know the basic differences:

-the record format of the "Netflow/Jflow" packets v5 are different from v10 so this might be already a first good point which differentiate the 2 version: v10 give more freedom in selecting which information we might want to sample (basically)

-v5 does not support IPv6

-for MX, v5 and v10 are only supported on MPC-3D line card

-v5 is based on rfc 3954

-v10 is based on RFC 7011, RFC 7012

So, assuming that I am only interested in IPv4 and I have an MX with line card MPC-3D I have than the freedom to implement the v5 or v10. what are the drawback in using sampling  from the RouteEngine (v5) or from the Packet Forward Engine (v10, IPFIX) in terms of "cpu´s" load or other resurces limitation which could impact the normal forwarding of the production traffic?

 Any idea?

Hi,

Here are my views regarding your query.

RE based sampling limitations:

• Since RE is handling all the control traffic on the router, we cannot configure very aggresive sampling rate as it will result in RE CPU getting over utilized resulting in instability.
• Routing Engine based sampling is not supported on VPN routing and forwarding (VRF) instances.

PFE based or inline sampling restrictions and limitations:

• You can configure inline sampling only on MX Series routers that have Trio-based line cards.
• You can apply Version 9 flow template only to IPv4 traffic.
• You can configure only one sampling instance on an Flexible PIC Concentrator (FPC).
• You can configure only one type of sampling–either PIC-based sampling or inline sampling–per family in a sampling instance. However, you can configure PIC-based and inline sampling for different families in a sampling instance.
• You can configure only one collector for inline sampling.

• The following considerations apply to the inline flow-monitoring instance configuration:

  • Sampling run-length and clip-size are not supported.
  • For inline configurations, each family can support only one collector.
• Inline sampling instances can handle only up to 65536 AS paths. If the total number of AS paths exceed the maximum limit, the AS paths that have AS index greater than 65536 are discarded and counted as error. Flow records associated with such AS paths show the AS value as 0xFFFFFFFF . However, this limitation does not impact normal forwarding operations.
• On routers with Multiservices PICs or Multiservices DPCs, all fragments of a fragmented IPv4 packet other than the first fragment of the packet are processed accurately by the flow monitoring application running on MS-PIC or MS-DPC. The flow monitoring mechanism handles such fragments accurately by setting the layer 4 related fields in the associated flows to zero.

For more details, please refer to following links:

Understanding Inline Sampling

Configuring Traffic Sampling

Hope this helps.

If this post was helpful, please mark this post as an "Accepted Solution".
Kudos are always appreciated!

Thanks

Hello,

Thank you for your contribution on my question. I did not have enough time to go through this topic during the last months in any case I appreciate your effort on this.

Hi,

>>You can configure only one type of sampling–either PIC-based sampling or inline sampling–per family in a sampling instance. >>However, you can configure PIC-based and inline sampling for different families in a sampling instance.

-> Maybe it is a late question, but trying to understand the difference between PIC-based and inline.

Thanks in advance.

Hello,

"Inline" - executed on Trio LU chip , or its equivalent (equivalent of separate LU chip in newer Trio single-chip versions). Can be done on any MPC linecard, no special separate HW is required. Requires license. 

"PIC-based" - executed on Services card (MS-DPC, MS-MPC, MS-MIC). Special separate HW (MS-DPC, MS-MPC or MS-MIC) is required, license is required.

HTH

Thx

Alex

aarseniev -Thank you very much for clarification!