示例：在 MX 系列路由器上配置流收集器接口
图 1 显示了受监控流量通过路由器时的路径。数据包到达输入接口 so-0/1/0、 so-3/0/0 和 so-3/1/0。原始数据包被定向到基于过滤器的转发路由实例，并由监控服务接口 mo-7/1/0、 mo-7/2/0 和 mo-7/3/0 处理成流记录。流记录在流收集器接口 cp-6/0/0 和 cp-7/0/0 上压缩成文件，并发送到 FTP 服务器进行分析。最后，将强制服务等级 （CoS） 配置应用于流收集器接口上的导出通道 0 和 1，以管理传出已处理的文件。
路由器 1
[edit]
chassis {
fpc 6 {
pic 0 {
monitoring-services {
application flow-collector; # This converts a Monitoring Services II PIC
} # into a flow collector interface.
}
}
fpc 7 {
pic 0 {
monitoring-services {
application flow-collector; # This converts a Monitoring Services II PIC
} # into a flow collector interface.
}
}
}
interfaces {
cp-6/0/0 {
unit 0 {# Logical interface .0 on a flow collector interface is export
family inet { # channel 0 and sends records to the FTP server.
filter {
output cp-ftp; # Apply the CoS filter here.
}
address 10.0.0.1/32 {
destination 10.0.0.2;
}
}
}
unit 1 { # Logical interface .1 on a flow collector interface is export
family inet { # channel 1 and sends records to the FTP server.
filter {
output cp-ftp; # Apply the CoS filter here.
}
address 10.1.1.1/32 {
destination 10.1.1.2;
}
}
}
unit 2 { # Logical interface .2 on a flow collector interface is the flow
family inet { # receive channel that communicates with the Routing Engine.
address 10.2.2.1/32 { # Do not apply a CoS filter on logical interface .2.
destination 10.2.2.2;
}
}
}
}
cp-7/0/0 {
unit 0 { # Logical interface .0 on a flow collector interface is export
family inet { # channel 0 and sends records to the FTP server.
filter {
output cp-ftp; # Apply the CoS filter here.
}
address 10.3.3.1/32 {
destination 10.3.3.2;
}
}
}
unit 1 { # Logical interface .1 on a flow collector interface is export
family inet { # channel 1 and sends records to the FTP server.
filter {
output cp-ftp; # Apply the CoS filter here.
}
address 10.4.4.1/32 {
destination 10.4.4.2;
}
}
}
unit 2 { # Logical interface .2 on a flow collector interface is the flow
family inet { # receive channel that communicates with the Routing Engine.
address 10.5.5.1/32 { # Do not apply a CoS filter on logical interface .2.
destination 10.5.5.2;
}
}
}
}
fe-1/3/0 { # This is the exit interface leading to the first FTP server.
unit 0 {
family inet {
address 192.168.56.90/30;
}
}
}
ge-1/0/0 { # This is the exit interface leading to the second FTP server.
unit 0 {
family inet {
address 192.168.252.2/24;
}
}
}
mo-7/1/0 { # This is the first interface that creates flow records.
unit 0 {
family inet;
}
}
mo-7/2/0 { # This is the second interface that creates flow records.
unit 0 {
family inet;
}
}
mo-7/3/0 { # This is the third interface that creates flow records.
unit 0 {
family inet;
}
}
so-0/1/0 { # This is the first input interface that receives traffic to be monitored.
encapsulation ppp;
unit 0 {
passive-monitor-mode; # This allows the interface to be passively monitored.
family inet {
filter {
input catch; # The filter-based forwarding filter is applied here.
}
}
}
}
so-3/0/0 { # This is the second interface that receives traffic to be monitored.
encapsulation ppp;
unit 0 {
passive-monitor-mode; # This allows the interface to be passively monitored.
family inet {
filter {
input catch; # The filter-based forwarding filter is applied here.
}
}
}
}
so-3/1/0 { # This is the third interface that receives traffic to be monitored.
encapsulation ppp;
unit 0 {
passive-monitor-mode; # This allows the interface to be passively monitored.
family inet {
filter {
input catch; # The filter-based forwarding filter is applied here.
}
}
}
}
}
forwarding-options {
monitoring group1 { # Always define your monitoring group here.
family inet {
output {
export-format cflowd-version-5;
flow-active-timeout 60;
flow-inactive-timeout 15;
flow-export-destination collector-pic; # Sends records to the flow collector.
interface mo-7/1/0.0 {
source-address 192.168.252.2;
}
interface mo-7/2/0.0 {
source-address 192.168.252.2;
}
interface mo-7/3/0.0 {
source-address 192.168.252.2;
}
}
}
}
}
routing-options {
interface-routes {
rib-group inet common;
}
rib-groups {
common {
import-rib [ inet.0 fbf_instance.inet.0 ];
}
}
forwarding-table {
export pplb;
}
}
policy-options {
policy-statement pplb {
then {
load-balance per-packet;
}
}
}
class-of-service { # A class-of-service configuration for the flow collector interface
interfaces { # is mandatory when implementing flow collector services.
cp-6/0/0 {
scheduler-map cp-map;
}
cp-7/0/0 {
scheduler-map cp-map;
}
}
scheduler-maps {
cp-map {
forwarding-class best-effort scheduler Q0;
forwarding-class expedited-forwarding scheduler Q1;
forwarding-class network-control scheduler Q3;
}
}
schedulers {
Q0 {
transmit-rate remainder;
buffer-size percent 90;
}
Q1 {
transmit-rate percent 5;
buffer-size percent 5;
priority strict-high;
}
Q3 {
transmit-rate percent 5;
buffer-size percent 5;
}
}
}
firewall {
family inet {
filter cp-ftp { # This filter provides CoS for flow collector interface traffic.
term t1 {
then forwarding-class expedited-forwarding;
}
}
}
filter catch { # This firewall filter sends incoming traffic into the
interface-specific; # filter-based forwarding routing instance.
term def {
then {
count counter;
routing-instance fbf_instance;
}
}
}
}
routing-instances {
fbf_instance { # This instance sends traffic to the monitoring services interface.
instance-type forwarding;
routing-options {
static {
route 0.0.0.0/0 next-hop mo-7/1/0.0;
}
}
}
}
services {
flow-collector { # Define properties for flow collector interfaces here.
analyzer-address 10.10.10.1; # This is the IP address of the analyzer.
analyzer-id server1; # This helps to identify the analyzer.
retry 3; # Maximum number of attempts by the PIC to send a file transfer log.
retry-delay 30; # The time interval between attempts to send a file transfer log.
destinations { # This defines the FTP servers that receive flow collector output.
"ftp://user@192.168.56.89//tmp/collect1/" { # The primary FTP server.
password "$ABC123"; # SECRET-DATA
}
"ftp://user@192.168.252.1//tmp/collect2/" { # The second FTP server.
password "$ABC123"; # SECRET-DATA
}
}
file-specification { # Define sets of flow collector characteristics here.
def-spec {
}
data-format flow-compressed; # The default compressed output format.
}
f1 {
name-format "cFlowd-py69Ni69-0-%D_%T-%I_%N.bcp.bi.gz";
data-format flow-compressed; # The default compressed output format.
transfer timeout 1800 record-level 1000000; # Here are configured values.
}
}
interface-map { # Allows you to map interfaces to flow collector interfaces.
file-specification def-spec; # Flows generated for default traffic are sent to the
collector cp-7/0/0; # default flow collector interface cp-7/0/0.
so-0/1/0.0 {# Flows generated for the so-0/1/0 interface are sent
collector cp-6/0/0; # to cp-6/0/0, and the file-specification used is “default”.
}
so-3/0/0.0 { # Flows generated for the so-3/0/0 interface are sent
file-specification f1; # to cp-6/0/0, and the file-specification used is "f1."
collector cp-6/0/0;
}
so-3/1/0.0; # Because no settings are defined, flows generated for this
}
transfer-log-archive { # Sends flow collector interface log files to an FTP server.
filename-prefix so_3_0_0_log;
maximum-age 15;
archive-sites {
"ftp://user@192.168.56.89//tmp/transfers/" {
password "$ABC123";
}
}
}
}
验证您的工作
要验证流收集器配置是否正常工作，请在为流收集配置的监控站上使用以下命令：
clear services flow-collector statisticsrequest services flow-collector change-destination (primary | secondary)request services flow-collector test-file-transfershow services flow-collector file interface (detail | extensive | terse)show services flow-collector (detail | extensive)show services flow-collector input interface (detail | extensive | terse)
以下部分显示了配置示例中使用的命令的 show 输出：
user@router1> show services flow-collector input interface cp-6/0/0 detail
Interface Packets Bytes
mo-7/1/0.0 6170 8941592
user@router1> show services flow-collector interface all detail
Flow collector interface: cp-6/0/0
Interface state: Collecting flows
Packets Bytes Flows Uncompressed Compressed FTP bytes FTP files
Bytes Bytes
6736 9757936 195993 21855798 3194148 0 0
Flow collector interface: cp-7/0/0
Interface state: Collecting flows
Packets Bytes Flows Uncompressed Compressed FTP bytes FTP files
Bytes Bytes
0 0 0 0 0 0 0
user@router1> show services flow-collector input interface cp-6/0/0 extensive
Interface Packets Bytes
mo-7/1/0.0 6260 9074096
user@router1> show services flow-collector interface cp-6/0/0 extensive
Flow collector interface: cp-6/0/0
Interface state: Collecting flows
Memory:
Used: 19593212, Free: 479528656
Input:
Packets: 6658, per second: 0, peak per second: 0
Bytes: 9647752, per second: 12655, peak per second: 14311
Flow records processed: 193782, per second: 252, peak per second: 287
Allocation:
Blocks allocated: 174, per second: 0, peak per second: 0
Blocks freed: 0, per second: 0, peak per second: 0
Blocks unavailable: 0, per second: 0, peak per second: 0
Files:
Files created: 1, per second: 0, peak per second: 0
Files exported: 0, per second: 0, peak per second: 0
Files destroyed: 0, per second: 0, peak per second: 0
Throughput:
Uncompressed bytes: 21075152, per second: 52032, peak per second: 156172
Compressed bytes: 3079713, per second: 7618, peak per second: 22999
Packet drops:
No memory: 0, Not IP: 0
Not IPv4: 0, Too small: 0
Fragments: 0, ICMP: 0
TCP: 0, Unknown: 0
Not JUNOS flow: 0
File Transfer:
FTP bytes: 0, per second: 0, peak per second: 0
FTP files: 0, per second: 0, peak per second: 0
FTP failure: 0
Export channel: 0
Current server: Secondary
Primary server state: OK, Secondary server state: OK
Export channel: 1
Current server: Secondary
Primary server state: OK, Secondary server state: OK
user@router1> show services flow-collector file interface cp-6/0/0 terse
File name Flows State
cFlowd-py69Ni69-0-20031112_014301-so_3_0_0_0.bcp.bi.gz 185643 Active
user@router1> show services flow-collector file interface cp-6/0/0 detail
Filename: cFlowd-py69Ni69-0-20031112_014301-so_3_0_0_0.bcp.bi.gz
Throughput:
Flow records: 187067, Uncompressed bytes: 21121960, Compressed bytes: 2965643
Status:
State: Active, Transfer attempts: 0
user@router1> show services flow-collector file interface cp-6/0/0 extensive
Filename: cFlowd-py69Ni69-0-20031112_014301-so_3_0_0_0.bcp.bi.gz
Throughput:
Flow records: 188365, per second: 238, peak per second: 287
Uncompressed bytes: 21267756, per second: 27007, peak per second: 32526
Compressed bytes: 2965643, per second: 0, peak per second: 22999
Status:
Compressed blocks: 156, Block count: 156
State: Active, Transfer attempts: 0
要清除流收集器接口的统计信息，请发出命令 clear services flow-collector statistics interface (all | interface-name) 。
另一个有用的流收集器选项允许您将 FTP 服务器从主服务器更改为辅助服务器，并测试 FTP 传输。要强制收集流接口使用主 FTP 服务器或辅助 FTP 服务器，请在发出request services flow-collector change-destination interface cp-fpc/pic/port 命令时包括主或辅助选项。
如果仅配置一个主服务器并使用 主 选项发出此命令，则会收到错误消息“不需要目标更改”。如果未配置辅助服务器，并且您使用 辅助 选项发出此命令，则会收到错误消息“目标未配置”。否则，当两个服务器配置正确时，成功输出显示如下。
user@router1> request services flow-collector change-destination interface cp-6/0/0 primary Flow collector interface: cp-6/0/0 Interface state: Collecting flows Destination change successful user@router1> request services flow-collector change-destination interface cp-6/0/0 secondary Flow collector interface: cp-6/0/0 Interface state: Collecting flows Destination change successful
该 request services flow-collector change-destination interface cp-fpc/pic/port 命令的其他选项包括 immediately （强制立即切换）、 gracefully （允许逐步切换的默认行为）、 clear-files （清除现有数据文件）和 clear-logs （清除现有日志文件）。
要验证传输日志文件是否已调度以传递到 FTP 服务器，请发出命令 request services flow-collector test-file-transfer filename interface cp-fpc/pic/port 。使用此命令包括所需的导出通道（0 或 1）和目标 FTP 服务器（主服务器或辅助服务器）。
user@router1> request services flow-collector test-file-transfer test_file interface cp-6/0/0 channel-one primary Flow collector interface: cp-6/0/0 Interface state: Collecting flows Response: Test file transfer successfully scheduled
检查文件传输是否成功的另一种方法是分析传输日志。传输日志发送有关流收集器接口收集和处理的文件的详细信息。 表 1 说明了传输日志中可用的各种字段。
字段 |
解释 |
|---|---|
FN |
文件名 |
SZ |
文件大小 |
NR |
记录数 |
TS |
时间戳的格式为年（4 位）、月（2 位）、日（2 位）、小时（2 位）、分钟（2 位）和秒（2 位）。 |
SF |
成功标志 - 值为 1 表示 成功，0 表示失败。 |
UL |
服务器 URL |
遥控 |
FTP 结果代码 |
ER |
FTP 错误文本 |
TT |
传输时间 |
以下是成功传输日志的示例：
fn="cFlowd-py69Ni69-0-20040227_230438-at_4_0_0_4_3.bcp.bi.gz":sz=552569 :nr=20000:ts="20040227230855":sf=1:ul="ftp://10.63.152.1/tmp/server1/:"rc=250: er="":tt=3280
以下是 FTP 会话失败时传输日志的示例：
fn="cFlowd-py69Ni69-0-20040227_230515-at_4_0_0_2_8.bcp.bi.gz":sz=560436 :nr=20000:ts="20040227230855":sf=1:ul="ftp://10.63.152.1/tmp/server1/:"rc=250 :er="":tt=3290
当流收集器接口接收并处理流记录时，PIC 服务日志记录进程 （fsad） 处理以下任务：
当流收集器接口将文件传输到 FTP 服务器时，将在 /var/log/flowc 目录中创建一个临时日志文件。临时日志文件具有以下文件命名约定：
<hostname>_<filename_prefix>_hhmmss.tmp YYYYMMDD
hostname 是传输服务器的主机名，filename_prefix与在 [edit services flow-collector transfer-log-archive] 层次结构级别使用语句定义
filename-prefix的值相同， YYYYMMDD 是年、月和日期， hhmmss 并且是指示小时、分钟和秒的时间戳。日志文件在路由器中存储了 [edit services flow-collector transfer-log-archive] 层次结构级别的语句指定的
maximum-age时间长度（默认为 120 分钟）后，临时日志文件将转换为实际日志文件，并删除临时文件。新的日志文件保留相同的命名约定，只是扩展名为 *.log。创建并压缩最终日志文件时，PIC 服务日志记录进程 （fsad） 会尝试将日志文件从 /var/log/flowc 目录发送到 FTP 服务器。通过在
archive-sites[edit services flow-collector transfer-log-archive] 层次结构级别包含该语句，最多可以指定五台 FTP 服务器来接收日志文件。日志记录过程会尝试将日志文件一次发送到一台服务器，按照它们在配置中的出现顺序排列。第一次传输成功后，日志文件将被删除，并且日志记录过程将停止将日志文件发送到列表中的剩余 FTP 服务器。如果日志文件传输不成功，则将日志文件移动到 /var/log/flowc/failed 目录中。日志记录进程每 30 分钟尝试重新发送一次日志文件。日志文件传输成功后，从 /var/log/flowc/failed 目录中删除。
注意：如果流收集器接口的内存已满，接口可能会丢弃传入的数据包。
当流收集器接口成功将处理后的信息文件传送到FTP服务器后，您可以对文件进行分析。该文件包含有关流收集器接口收集和处理的流量的详细信息。 表 2 介绍了流收集器接口文件中可用的各种字段。
字段 |
解释 |
|---|---|
链接目录 |
链路目录 - 随机生成的编号，用于识别记录 |
分析器地址 |
分析器地址 |
分析器 ID |
分析器标识符 |
if别名 |
接口标识符 |
源-地址 |
源地址 |
目标地址 |
目标地址 |
数据包 |
数据包数 |
字节 |
字节数 |
开始时间 |
开始时间 |
结束时间 |
结束时间 |
源端口 |
源端口 |
目标端口 |
目标端口 |
tcp_flag |
TCP 标志 |
协议 |
IP 协议号 |
src_AS 编号 |
源 AS 编号 |
dst_AS 编号 |
目标 AS 编号 |
以下是流收集器接口文件的输出示例：
11799241612374557782|10.10.10.1|server1|at_4_0_0_4|192.168.10.100|10.0.0.1|8| 3136|1077926402|1077926402|8224|12336|27|6|0|0