示例：在 M、MX 或 T 系列路由器上配置流收集器接口
图 1：流收集器接口拓扑图
图 1 显示了受监控流量在通过路由器时传输的路径。数据包会到达输入接口 so-0/1/0、so-3/0/0 和 so-3/1/0。原始数据包被定向到基于过滤器的转发路由实例，并由监控服务接口 mo-7/1/0、mo-7/2/0 和 mo-7/3/0 处理成流记录。流记录在流收集器接口 cp-6/0/0 和 cp-7/0/0/0 处压缩成文件，并发送至 FTP 服务器进行分析。最后，会应用必需的服务等级 （CoS） 配置，以在流收集器接口上导出通道 0 和 1，以管理传出处理的文件。
路由器 1
[edit]
chassis {
fpc 6 {
pic 0 {
monitoring-services {
application flow-collector; # This converts a Monitoring Services II PIC
} # into a flow collector interface.
}
}
fpc 7 {
pic 0 {
monitoring-services {
application flow-collector; # This converts a Monitoring Services II PIC
} # into a flow collector interface.
}
}
}
interfaces {
cp-6/0/0 {
unit 0 {# Logical interface .0 on a flow collector interface is export
family inet { # channel 0 and sends records to the FTP server.
filter {
output cp-ftp; # Apply the CoS filter here.
}
address 10.0.0.1/32 {
destination 10.0.0.2;
}
}
}
unit 1 { # Logical interface .1 on a flow collector interface is export
family inet { # channel 1 and sends records to the FTP server.
filter {
output cp-ftp; # Apply the CoS filter here.
}
address 10.1.1.1/32 {
destination 10.1.1.2;
}
}
}
unit 2 { # Logical interface .2 on a flow collector interface is the flow
family inet { # receive channel that communicates with the Routing Engine.
address 10.2.2.1/32 { # Do not apply a CoS filter on logical interface .2.
destination 10.2.2.2;
}
}
}
}
cp-7/0/0 {
unit 0 { # Logical interface .0 on a flow collector interface is export
family inet { # channel 0 and sends records to the FTP server.
filter {
output cp-ftp; # Apply the CoS filter here.
}
address 10.3.3.1/32 {
destination 10.3.3.2;
}
}
}
unit 1 { # Logical interface .1 on a flow collector interface is export
family inet { # channel 1 and sends records to the FTP server.
filter {
output cp-ftp; # Apply the CoS filter here.
}
address 10.4.4.1/32 {
destination 10.4.4.2;
}
}
}
unit 2 { # Logical interface .2 on a flow collector interface is the flow
family inet { # receive channel that communicates with the Routing Engine.
address 10.5.5.1/32 { # Do not apply a CoS filter on logical interface .2.
destination 10.5.5.2;
}
}
}
}
fe-1/3/0 { # This is the exit interface leading to the first FTP server.
unit 0 {
family inet {
address 192.168.56.90/30;
}
}
}
ge-1/0/0 { # This is the exit interface leading to the second FTP server.
unit 0 {
family inet {
address 192.168.252.2/24;
}
}
}
mo-7/1/0 { # This is the first interface that creates flow records.
unit 0 {
family inet;
}
}
mo-7/2/0 { # This is the second interface that creates flow records.
unit 0 {
family inet;
}
}
mo-7/3/0 { # This is the third interface that creates flow records.
unit 0 {
family inet;
}
}
so-0/1/0 { # This is the first input interface that receives traffic to be monitored.
encapsulation ppp;
unit 0 {
passive-monitor-mode; # This allows the interface to be passively monitored.
family inet {
filter {
input catch; # The filter-based forwarding filter is applied here.
}
}
}
}
so-3/0/0 { # This is the second interface that receives traffic to be monitored.
encapsulation ppp;
unit 0 {
passive-monitor-mode; # This allows the interface to be passively monitored.
family inet {
filter {
input catch; # The filter-based forwarding filter is applied here.
}
}
}
}
so-3/1/0 { # This is the third interface that receives traffic to be monitored.
encapsulation ppp;
unit 0 {
passive-monitor-mode; # This allows the interface to be passively monitored.
family inet {
filter {
input catch; # The filter-based forwarding filter is applied here.
}
}
}
}
}
forwarding-options {
monitoring group1 { # Always define your monitoring group here.
family inet {
output {
export-format cflowd-version-5;
flow-active-timeout 60;
flow-inactive-timeout 15;
flow-export-destination collector-pic; # Sends records to the flow collector.
interface mo-7/1/0.0 {
source-address 192.168.252.2;
}
interface mo-7/2/0.0 {
source-address 192.168.252.2;
}
interface mo-7/3/0.0 {
source-address 192.168.252.2;
}
}
}
}
}
routing-options {
interface-routes {
rib-group inet common;
}
rib-groups {
common {
import-rib [ inet.0 fbf_instance.inet.0 ];
}
}
forwarding-table {
export pplb;
}
}
policy-options {
policy-statement pplb {
then {
load-balance per-packet;
}
}
}
class-of-service { # A class-of-service configuration for the flow collector interface
interfaces { # is mandatory when implementing flow collector services.
cp-6/0/0 {
scheduler-map cp-map;
}
cp-7/0/0 {
scheduler-map cp-map;
}
}
scheduler-maps {
cp-map {
forwarding-class best-effort scheduler Q0;
forwarding-class expedited-forwarding scheduler Q1;
forwarding-class network-control scheduler Q3;
}
}
schedulers {
Q0 {
transmit-rate remainder;
buffer-size percent 90;
}
Q1 {
transmit-rate percent 5;
buffer-size percent 5;
priority strict-high;
}
Q3 {
transmit-rate percent 5;
buffer-size percent 5;
}
}
}
firewall {
family inet {
filter cp-ftp { # This filter provides CoS for flow collector interface traffic.
term t1 {
then forwarding-class expedited-forwarding;
}
}
}
filter catch { # This firewall filter sends incoming traffic into the
interface-specific; # filter-based forwarding routing instance.
term def {
then {
count counter;
routing-instance fbf_instance;
}
}
}
}
routing-instances {
fbf_instance { # This instance sends traffic to the monitoring services interface.
instance-type forwarding;
routing-options {
static {
route 0.0.0.0/0 next-hop mo-7/1/0.0;
}
}
}
}
services {
flow-collector { # Define properties for flow collector interfaces here.
analyzer-address 10.10.10.1; # This is the IP address of the analyzer.
analyzer-id server1; # This helps to identify the analyzer.
retry 3; # Maximum number of attempts by the PIC to send a file transfer log.
retry-delay 30; # The time interval between attempts to send a file transfer log.
destinations { # This defines the FTP servers that receive flow collector output.
"ftp://user@192.168.56.89//tmp/collect1/" { # The primary FTP server.
password "$ABC123"; # SECRET-DATA
}
"ftp://user@192.168.252.1//tmp/collect2/" { # The second FTP server.
password "$ABC123"; # SECRET-DATA
}
}
file-specification { # Define sets of flow collector characteristics here.
def-spec {
}
data-format flow-compressed; # The default compressed output format.
}
f1 {
name-format "cFlowd-py69Ni69-0-%D_%T-%I_%N.bcp.bi.gz";
data-format flow-compressed; # The default compressed output format.
transfer timeout 1800 record-level 1000000; # Here are configured values.
}
}
interface-map { # Allows you to map interfaces to flow collector interfaces.
file-specification def-spec; # Flows generated for default traffic are sent to the
collector cp-7/0/0; # default flow collector interface cp-7/0/0.
so-0/1/0.0 {# Flows generated for the so-0/1/0 interface are sent
collector cp-6/0/0; # to cp-6/0/0, and the file-specification used is “default”.
}
so-3/0/0.0 { # Flows generated for the so-3/0/0 interface are sent
file-specification f1; # to cp-6/0/0, and the file-specification used is "f1."
collector cp-6/0/0;
}
so-3/1/0.0; # Because no settings are defined, flows generated for this
}
transfer-log-archive { # Sends flow collector interface log files to an FTP server.
filename-prefix so_3_0_0_log;
maximum-age 15;
archive-sites {
"ftp://user@192.168.56.89//tmp/transfers/" {
password "$ABC123";
}
}
}
}
验证您的工作
要验证流收集器配置是否工作，请在为流收集配置的监控站上使用以下命令：
clear services flow-collector statisticsrequest services flow-collector change-destination (primary | secondary)request services flow-collector test-file-transfershow services flow-collector file interface (detail | extensive | terse)show services flow-collector (detail | extensive)show services flow-collector input interface (detail | extensive | terse)
以下部分显示了与配置示例一起使用的命令的输出 show ：
user@router1> show services flow-collector input interface cp-6/0/0 detail
Interface Packets Bytes
mo-7/1/0.0 6170 8941592
user@router1> show services flow-collector interface all detail
Flow collector interface: cp-6/0/0
Interface state: Collecting flows
Packets Bytes Flows Uncompressed Compressed FTP bytes FTP files
Bytes Bytes
6736 9757936 195993 21855798 3194148 0 0
Flow collector interface: cp-7/0/0
Interface state: Collecting flows
Packets Bytes Flows Uncompressed Compressed FTP bytes FTP files
Bytes Bytes
0 0 0 0 0 0 0
user@router1> show services flow-collector input interface cp-6/0/0 extensive
Interface Packets Bytes
mo-7/1/0.0 6260 9074096
user@router1> show services flow-collector interface cp-6/0/0 extensive
Flow collector interface: cp-6/0/0
Interface state: Collecting flows
Memory:
Used: 19593212, Free: 479528656
Input:
Packets: 6658, per second: 0, peak per second: 0
Bytes: 9647752, per second: 12655, peak per second: 14311
Flow records processed: 193782, per second: 252, peak per second: 287
Allocation:
Blocks allocated: 174, per second: 0, peak per second: 0
Blocks freed: 0, per second: 0, peak per second: 0
Blocks unavailable: 0, per second: 0, peak per second: 0
Files:
Files created: 1, per second: 0, peak per second: 0
Files exported: 0, per second: 0, peak per second: 0
Files destroyed: 0, per second: 0, peak per second: 0
Throughput:
Uncompressed bytes: 21075152, per second: 52032, peak per second: 156172
Compressed bytes: 3079713, per second: 7618, peak per second: 22999
Packet drops:
No memory: 0, Not IP: 0
Not IPv4: 0, Too small: 0
Fragments: 0, ICMP: 0
TCP: 0, Unknown: 0
Not JUNOS flow: 0
File Transfer:
FTP bytes: 0, per second: 0, peak per second: 0
FTP files: 0, per second: 0, peak per second: 0
FTP failure: 0
Export channel: 0
Current server: Secondary
Primary server state: OK, Secondary server state: OK
Export channel: 1
Current server: Secondary
Primary server state: OK, Secondary server state: OK
user@router1> show services flow-collector file interface cp-6/0/0 terse
File name Flows State
cFlowd-py69Ni69-0-20031112_014301-so_3_0_0_0.bcp.bi.gz 185643 Active
user@router1> show services flow-collector file interface cp-6/0/0 detail
Filename: cFlowd-py69Ni69-0-20031112_014301-so_3_0_0_0.bcp.bi.gz
Throughput:
Flow records: 187067, Uncompressed bytes: 21121960, Compressed bytes: 2965643
Status:
State: Active, Transfer attempts: 0
user@router1> show services flow-collector file interface cp-6/0/0 extensive
Filename: cFlowd-py69Ni69-0-20031112_014301-so_3_0_0_0.bcp.bi.gz
Throughput:
Flow records: 188365, per second: 238, peak per second: 287
Uncompressed bytes: 21267756, per second: 27007, peak per second: 32526
Compressed bytes: 2965643, per second: 0, peak per second: 22999
Status:
Compressed blocks: 156, Block count: 156
State: Active, Transfer attempts: 0
要清除流收集器接口的统计信息，请发出 clear services flow-collector statistics interface (all | interface-name) 命令。
另一个有用的流收集器选项允许您将 FTP 服务器从主要服务器更改为辅助服务器，并测试 FTP 传输。要强制流收集器接口使用主或辅助 FTP 服务器，在发出request services flow-collector change-destination interface cp-fpc/pic/port 命令时包括主要或辅助选项。
如果仅配置一个主服务器并使用 主 选项发出此命令，则会收到“不需要目标更改”的错误消息。如果未配置辅助服务器，并且使用 辅助 选项发出此命令，则会收到“未配置目标”的错误消息。否则，当两个服务器配置正确后，成功输出将显示如下。
user@router1> request services flow-collector change-destination interface cp-6/0/0 primary Flow collector interface: cp-6/0/0 Interface state: Collecting flows Destination change successful user@router1> request services flow-collector change-destination interface cp-6/0/0 secondary Flow collector interface: cp-6/0/0 Interface state: Collecting flows Destination change successful
命令的其他选项 request services flow-collector change-destination interface cp-fpc/pic/port 包括 立即 （强制立即切换）、 平滑 （允许逐步切换的默认行为）、 清除文件 （清除现有数据文件）和 清除日志 （清除现有日志文件）。
要验证传输日志文件是否已计划传输到 FTP 服务器，请发出 request services flow-collector test-file-transfer filename interface cp-fpc/pic/port 命令。使用此命令包括所需的导出通道（零或一个）和目标 FTP 服务器（主要或次要）。
user@router1> request services flow-collector test-file-transfer test_file interface cp-6/0/0 channel-one primary Flow collector interface: cp-6/0/0 Interface state: Collecting flows Response: Test file transfer successfully scheduled
检查文件传输是否成功的另一种方法是分析传输日志。传输日志发送有关由流收集器接口收集和处理的文件的详细信息。 表 1 说明了传输日志中提供的各个字段。
领域 |
解释 |
|---|---|
Fn |
文件名 |
深圳 |
文件的大小 |
星期日 |
记录数 |
Ts |
时间戳，格式为年（4 位数字）、月（2 位数字）、天（2 位数字）、小时（2 位数）、分钟（2 位数）和秒（2 位数字）。 |
S f |
成功标志 — 值 1 用于成功， 0 用于失败。 |
Ul |
服务器 URL |
钢筋混凝土 |
FTP 结果代码 |
二 |
FTP 错误文本 |
Tt |
传输时间 |
以下是成功的传输日志示例：
fn="cFlowd-py69Ni69-0-20040227_230438-at_4_0_0_4_3.bcp.bi.gz":sz=552569 :nr=20000:ts="20040227230855":sf=1:ul="ftp://10.63.152.1/tmp/server1/:"rc=250: er="":tt=3280
这是 FTP 会话失败时的传输日志示例：
fn="cFlowd-py69Ni69-0-20040227_230515-at_4_0_0_2_8.bcp.bi.gz":sz=560436 :nr=20000:ts="20040227230855":sf=1:ul="ftp://10.63.152.1/tmp/server1/:"rc=250 :er="":tt=3290
当流收集器接口接收并处理流记录时，PIC 服务日志记录进程 （fsad） 会处理以下任务：
当流收集器接口将文件传输到 FTP 服务器时，在 /var/log/flowc 目录中创建一个临时日志文件。临时日志文件中使用此文件，名为约定：
hostname<>_<filename_prefix>_ YYYYMMDD_hhmmss.tmp
hostname 是传输服务器的主机名，filename_prefix是 [编辑服务流收集器 transfer-log-archive] 层次结构级别使用
filename-prefix语句定义的相同值， YYYYMMDD 是年、月份和日期，时间戳 hhmmss 表示小时、分和秒。日志文件在路由器中存储了 [编辑服务流收集器 transfer-log-archive] 层次结构级别上语句指定的
maximum-age时间长度（默认为 120 分钟）后，临时日志文件将转换为实际日志文件，并删除临时文件。新日志文件保留相同的命名约定，除了扩展名为*.log。创建和压缩最终日志文件后，PIC 服务日志记录进程 （fsad） 会尝试将日志文件从 /var/log/flowc 目录发送至 FTP 服务器。您可以在 [编辑服务流收集器 transfer-log-archive] 层次结构级别包含
archive-sites语句，从而指定最多五台 FTP 服务器来接收日志文件。日志记录进程会尝试将日志文件一次发送到一个服务器，其顺序是按照其在配置中出现的顺序。第一次成功传输后，日志文件将被删除，并且日志记录进程将停止向列表中剩余的 FTP 服务器发送日志文件。如果日志文件传输不成功，日志文件将移动到 /var/log/flowc/failed 目录中。每 30 分钟，日志记录进程会尝试重新发送日志文件。成功传输日志文件后，将从 /var/log/flowc/failed 目录中将其删除。
注意：如果流收集器接口的内存已满，接口可能会丢弃传入数据包。
流收集器接口成功将处理的信息文件传递到 FTP 服务器后，您可以分析该文件。该文件包含流收集器接口收集和处理的流的详细信息。 表 2 说明了流收集器接口文件中提供的各个字段。
领域 |
解释 |
|---|---|
linkDir |
链路目录 — 随机生成的数字，用于识别记录 |
分析器地址 |
分析器地址 |
分析器 ID |
分析器标识符 |
ifAlias |
接口标识符 |
源地址 |
源地址 |
目标地址 |
目标地址 |
包 |
数据包数 |
字节 |
字节数 |
开始时间 |
开始时间 |
结束时间 |
结束时间 |
源端口 |
源端口 |
目标端口 |
目标端口 |
tcp_flag |
TCP 标志 |
协议 |
IP 协议编号 |
src_AS_number |
源 AS 编号 |
dst_AS_number |
目标 AS 编号 |
以下是流收集器接口文件的输出示例：
11799241612374557782|10.10.10.1|server1|at_4_0_0_4|192.168.10.100|10.0.0.1|8| 3136|1077926402|1077926402|8224|12336|27|6|0|0