示例：在 M、MX 或 T Series 路由器上配置流收集器接口
图 1 显示了受监控流量在通过路由器时经过的路径。数据包到达输入接口 so-0/1/0、 so-3/0/0 和 so-3/1/0。原始数据包被定向到基于过滤器的转发路由实例，并由监控服务接口 mo-7/1/0、 mo-7/2/0 和 mo-7/3/0 处理成流记录。流记录在流收集器接口 cp-6/0/0 和 cp-7/0/0 处压缩成文件，并发送到 FTP 服务器进行分析。最后，将对流收集器接口上的导出通道 0 和 1 应用强制性服务等级 （CoS） 配置，以管理传出处理的文件。
路由器 1
[edit]
chassis {
fpc 6 {
pic 0 {
monitoring-services {
application flow-collector; # This converts a Monitoring Services II PIC
} # into a flow collector interface.
}
}
fpc 7 {
pic 0 {
monitoring-services {
application flow-collector; # This converts a Monitoring Services II PIC
} # into a flow collector interface.
}
}
}
interfaces {
cp-6/0/0 {
unit 0 {# Logical interface .0 on a flow collector interface is export
family inet { # channel 0 and sends records to the FTP server.
filter {
output cp-ftp; # Apply the CoS filter here.
}
address 10.0.0.1/32 {
destination 10.0.0.2;
}
}
}
unit 1 { # Logical interface .1 on a flow collector interface is export
family inet { # channel 1 and sends records to the FTP server.
filter {
output cp-ftp; # Apply the CoS filter here.
}
address 10.1.1.1/32 {
destination 10.1.1.2;
}
}
}
unit 2 { # Logical interface .2 on a flow collector interface is the flow
family inet { # receive channel that communicates with the Routing Engine.
address 10.2.2.1/32 { # Do not apply a CoS filter on logical interface .2.
destination 10.2.2.2;
}
}
}
}
cp-7/0/0 {
unit 0 { # Logical interface .0 on a flow collector interface is export
family inet { # channel 0 and sends records to the FTP server.
filter {
output cp-ftp; # Apply the CoS filter here.
}
address 10.3.3.1/32 {
destination 10.3.3.2;
}
}
}
unit 1 { # Logical interface .1 on a flow collector interface is export
family inet { # channel 1 and sends records to the FTP server.
filter {
output cp-ftp; # Apply the CoS filter here.
}
address 10.4.4.1/32 {
destination 10.4.4.2;
}
}
}
unit 2 { # Logical interface .2 on a flow collector interface is the flow
family inet { # receive channel that communicates with the Routing Engine.
address 10.5.5.1/32 { # Do not apply a CoS filter on logical interface .2.
destination 10.5.5.2;
}
}
}
}
fe-1/3/0 { # This is the exit interface leading to the first FTP server.
unit 0 {
family inet {
address 192.168.56.90/30;
}
}
}
ge-1/0/0 { # This is the exit interface leading to the second FTP server.
unit 0 {
family inet {
address 192.168.252.2/24;
}
}
}
mo-7/1/0 { # This is the first interface that creates flow records.
unit 0 {
family inet;
}
}
mo-7/2/0 { # This is the second interface that creates flow records.
unit 0 {
family inet;
}
}
mo-7/3/0 { # This is the third interface that creates flow records.
unit 0 {
family inet;
}
}
so-0/1/0 { # This is the first input interface that receives traffic to be monitored.
encapsulation ppp;
unit 0 {
passive-monitor-mode; # This allows the interface to be passively monitored.
family inet {
filter {
input catch; # The filter-based forwarding filter is applied here.
}
}
}
}
so-3/0/0 { # This is the second interface that receives traffic to be monitored.
encapsulation ppp;
unit 0 {
passive-monitor-mode; # This allows the interface to be passively monitored.
family inet {
filter {
input catch; # The filter-based forwarding filter is applied here.
}
}
}
}
so-3/1/0 { # This is the third interface that receives traffic to be monitored.
encapsulation ppp;
unit 0 {
passive-monitor-mode; # This allows the interface to be passively monitored.
family inet {
filter {
input catch; # The filter-based forwarding filter is applied here.
}
}
}
}
}
forwarding-options {
monitoring group1 { # Always define your monitoring group here.
family inet {
output {
export-format cflowd-version-5;
flow-active-timeout 60;
flow-inactive-timeout 15;
flow-export-destination collector-pic; # Sends records to the flow collector.
interface mo-7/1/0.0 {
source-address 192.168.252.2;
}
interface mo-7/2/0.0 {
source-address 192.168.252.2;
}
interface mo-7/3/0.0 {
source-address 192.168.252.2;
}
}
}
}
}
routing-options {
interface-routes {
rib-group inet common;
}
rib-groups {
common {
import-rib [ inet.0 fbf_instance.inet.0 ];
}
}
forwarding-table {
export pplb;
}
}
policy-options {
policy-statement pplb {
then {
load-balance per-packet;
}
}
}
class-of-service { # A class-of-service configuration for the flow collector interface
interfaces { # is mandatory when implementing flow collector services.
cp-6/0/0 {
scheduler-map cp-map;
}
cp-7/0/0 {
scheduler-map cp-map;
}
}
scheduler-maps {
cp-map {
forwarding-class best-effort scheduler Q0;
forwarding-class expedited-forwarding scheduler Q1;
forwarding-class network-control scheduler Q3;
}
}
schedulers {
Q0 {
transmit-rate remainder;
buffer-size percent 90;
}
Q1 {
transmit-rate percent 5;
buffer-size percent 5;
priority strict-high;
}
Q3 {
transmit-rate percent 5;
buffer-size percent 5;
}
}
}
firewall {
family inet {
filter cp-ftp { # This filter provides CoS for flow collector interface traffic.
term t1 {
then forwarding-class expedited-forwarding;
}
}
}
filter catch { # This firewall filter sends incoming traffic into the
interface-specific; # filter-based forwarding routing instance.
term def {
then {
count counter;
routing-instance fbf_instance;
}
}
}
}
routing-instances {
fbf_instance { # This instance sends traffic to the monitoring services interface.
instance-type forwarding;
routing-options {
static {
route 0.0.0.0/0 next-hop mo-7/1/0.0;
}
}
}
}
services {
flow-collector { # Define properties for flow collector interfaces here.
analyzer-address 10.10.10.1; # This is the IP address of the analyzer.
analyzer-id server1; # This helps to identify the analyzer.
retry 3; # Maximum number of attempts by the PIC to send a file transfer log.
retry-delay 30; # The time interval between attempts to send a file transfer log.
destinations { # This defines the FTP servers that receive flow collector output.
"ftp://user@192.168.56.89//tmp/collect1/" { # The primary FTP server.
password "$ABC123"; # SECRET-DATA
}
"ftp://user@192.168.252.1//tmp/collect2/" { # The second FTP server.
password "$ABC123"; # SECRET-DATA
}
}
file-specification { # Define sets of flow collector characteristics here.
def-spec {
}
data-format flow-compressed; # The default compressed output format.
}
f1 {
name-format "cFlowd-py69Ni69-0-%D_%T-%I_%N.bcp.bi.gz";
data-format flow-compressed; # The default compressed output format.
transfer timeout 1800 record-level 1000000; # Here are configured values.
}
}
interface-map { # Allows you to map interfaces to flow collector interfaces.
file-specification def-spec; # Flows generated for default traffic are sent to the
collector cp-7/0/0; # default flow collector interface cp-7/0/0.
so-0/1/0.0 {# Flows generated for the so-0/1/0 interface are sent
collector cp-6/0/0; # to cp-6/0/0, and the file-specification used is “default”.
}
so-3/0/0.0 { # Flows generated for the so-3/0/0 interface are sent
file-specification f1; # to cp-6/0/0, and the file-specification used is "f1."
collector cp-6/0/0;
}
so-3/1/0.0; # Because no settings are defined, flows generated for this
}
transfer-log-archive { # Sends flow collector interface log files to an FTP server.
filename-prefix so_3_0_0_log;
maximum-age 15;
archive-sites {
"ftp://user@192.168.56.89//tmp/transfers/" {
password "$ABC123";
}
}
}
}
验证您的工作
要验证流收集器配置是否正常工作，请在为流收集配置的监控站上使用以下命令：
clear services flow-collector statisticsrequest services flow-collector change-destination (primary | secondary)request services flow-collector test-file-transfershow services flow-collector file interface (detail | extensive | terse)show services flow-collector (detail | extensive)show services flow-collector input interface (detail | extensive | terse)
以下部分显示了与配置示例一起使用的命令 show 的输出：
user@router1> show services flow-collector input interface cp-6/0/0 detail
Interface Packets Bytes
mo-7/1/0.0 6170 8941592
user@router1> show services flow-collector interface all detail
Flow collector interface: cp-6/0/0
Interface state: Collecting flows
Packets Bytes Flows Uncompressed Compressed FTP bytes FTP files
Bytes Bytes
6736 9757936 195993 21855798 3194148 0 0
Flow collector interface: cp-7/0/0
Interface state: Collecting flows
Packets Bytes Flows Uncompressed Compressed FTP bytes FTP files
Bytes Bytes
0 0 0 0 0 0 0
user@router1> show services flow-collector input interface cp-6/0/0 extensive
Interface Packets Bytes
mo-7/1/0.0 6260 9074096
user@router1> show services flow-collector interface cp-6/0/0 extensive
Flow collector interface: cp-6/0/0
Interface state: Collecting flows
Memory:
Used: 19593212, Free: 479528656
Input:
Packets: 6658, per second: 0, peak per second: 0
Bytes: 9647752, per second: 12655, peak per second: 14311
Flow records processed: 193782, per second: 252, peak per second: 287
Allocation:
Blocks allocated: 174, per second: 0, peak per second: 0
Blocks freed: 0, per second: 0, peak per second: 0
Blocks unavailable: 0, per second: 0, peak per second: 0
Files:
Files created: 1, per second: 0, peak per second: 0
Files exported: 0, per second: 0, peak per second: 0
Files destroyed: 0, per second: 0, peak per second: 0
Throughput:
Uncompressed bytes: 21075152, per second: 52032, peak per second: 156172
Compressed bytes: 3079713, per second: 7618, peak per second: 22999
Packet drops:
No memory: 0, Not IP: 0
Not IPv4: 0, Too small: 0
Fragments: 0, ICMP: 0
TCP: 0, Unknown: 0
Not JUNOS flow: 0
File Transfer:
FTP bytes: 0, per second: 0, peak per second: 0
FTP files: 0, per second: 0, peak per second: 0
FTP failure: 0
Export channel: 0
Current server: Secondary
Primary server state: OK, Secondary server state: OK
Export channel: 1
Current server: Secondary
Primary server state: OK, Secondary server state: OK
user@router1> show services flow-collector file interface cp-6/0/0 terse
File name Flows State
cFlowd-py69Ni69-0-20031112_014301-so_3_0_0_0.bcp.bi.gz 185643 Active
user@router1> show services flow-collector file interface cp-6/0/0 detail
Filename: cFlowd-py69Ni69-0-20031112_014301-so_3_0_0_0.bcp.bi.gz
Throughput:
Flow records: 187067, Uncompressed bytes: 21121960, Compressed bytes: 2965643
Status:
State: Active, Transfer attempts: 0
user@router1> show services flow-collector file interface cp-6/0/0 extensive
Filename: cFlowd-py69Ni69-0-20031112_014301-so_3_0_0_0.bcp.bi.gz
Throughput:
Flow records: 188365, per second: 238, peak per second: 287
Uncompressed bytes: 21267756, per second: 27007, peak per second: 32526
Compressed bytes: 2965643, per second: 0, peak per second: 22999
Status:
Compressed blocks: 156, Block count: 156
State: Active, Transfer attempts: 0
要清除流收集器接口的统计信息，请发出 clear services flow-collector statistics interface (all | interface-name) 命令。
另一个有用的流收集器选项允许您将 FTP 服务器从主服务器更改为辅助服务器，并测试 FTP 传输。要强制流收集器接口使用主 FTP 服务器或辅助 FTP 服务器，请在发出request services flow-collector change-destination interface cp-fpc/pic/port 命令时包括主或辅助选项。
如果仅配置一台主服务器并使用 主 选项发出此命令，则会收到错误消息“不需要更改目标”。如果未配置辅助服务器，并且使用 辅助 选项发出此命令，则会收到错误消息“目标未配置”。否则，当两台服务器都配置正确时，成功的输出将显示如下所示。
user@router1> request services flow-collector change-destination interface cp-6/0/0 primary Flow collector interface: cp-6/0/0 Interface state: Collecting flows Destination change successful user@router1> request services flow-collector change-destination interface cp-6/0/0 secondary Flow collector interface: cp-6/0/0 Interface state: Collecting flows Destination change successful
命令的其他 request services flow-collector change-destination interface cp-fpc/pic/port 选项包括 立即 （强制即时切换）、 gracefully （允许逐步切换的默认行为）、 clear-files （清除现有数据文件）和 clear-logs （清除现有日志文件）。
要验证传输日志文件是否计划传送到 FTP 服务器，请发出 request services flow-collector test-file-transfer filename interface cp-fpc/pic/port 命令。使用此命令包括所需的导出通道（零或一）和目标 FTP 服务器（主服务器或辅助服务器）。
user@router1> request services flow-collector test-file-transfer test_file interface cp-6/0/0 channel-one primary Flow collector interface: cp-6/0/0 Interface state: Collecting flows Response: Test file transfer successfully scheduled
检查文件传输是否成功的另一种方法是分析传输日志。传输日志发送有关流收集器接口收集和处理的文件的详细信息。 表 1 说明了传输日志中可用的各种字段。
田 |
解释 |
|---|---|
FN |
文件名 |
深圳 |
文件大小 |
星期日 |
记录数 |
TS |
时间戳的格式为年（4 位数字）、月份（2 位数字）、星期（2 位数字）、小时（2 位数字）、分钟（2 位数字）和秒（2 位数字）。 |
SF |
成功标志 - 值为 1 表示成功， 0 表示失败。 |
UL |
服务器 URL |
钢筋混凝土 |
FTP 结果代码 |
的 |
FTP 错误文本 |
TT |
换乘时间 |
以下是成功传输日志的示例：
fn="cFlowd-py69Ni69-0-20040227_230438-at_4_0_0_4_3.bcp.bi.gz":sz=552569 :nr=20000:ts="20040227230855":sf=1:ul="ftp://10.63.152.1/tmp/server1/:"rc=250: er="":tt=3280
以下是 FTP 会话失败时的传输日志示例：
fn="cFlowd-py69Ni69-0-20040227_230515-at_4_0_0_2_8.bcp.bi.gz":sz=560436 :nr=20000:ts="20040227230855":sf=1:ul="ftp://10.63.152.1/tmp/server1/:"rc=250 :er="":tt=3290
当流收集器接口接收并处理流记录时，PIC 服务日志记录进程 （fsad） 将处理以下任务：
当流收集器接口将文件传输到 FTP 服务器时，将在 /var/log/flowc 目录中创建一个临时日志文件。临时日志文件具有以下文件命名约定：
<hostname>_<filename_prefix>_ YYYYMMDD_hhmmss.tmp
hostname 是传输服务器的主机名， filename_prefix 是使用
filename-prefix[Edit Services flow-collector transfer-log-archive] 层次结构级别上的语句定义的相同值， YYYYMMDD 是年、月和日期， hhmmss 是指示小时、分钟和秒的时间戳。日志文件在路由器中存储到语句在层次结构级别指定的时间
maximum-age长度（默认值为 120 分钟）后，临时日志文件将转换为实际日志文件，并删除临时文件。新的日志文件保留了相同的命名约定，只是扩展名是 *.log。创建并压缩最终日志文件时，PIC 服务日志记录进程 （fsad） 会尝试将日志文件从 /var/log/flowc 目录发送到 FTP 服务器。通过在 [edit services flow-collector transfer-log-archive] 层次结构级别包含
archive-sites语句，可以指定最多 5 个 FTP 服务器来接收日志文件。日志记录过程尝试按照日志文件在配置中的出现顺序一次将日志文件发送到一台服务器。首次成功传输后，日志文件将被删除，日志记录过程将停止向列表中的其余 FTP 服务器发送日志文件。如果日志文件传输不成功，日志文件将移动到 /var/log/flowc/failed 目录。每隔 30 分钟，日志记录过程就会尝试重新发送日志文件。成功传输日志文件后，它们将从 /var/log/flowc/failed 目录中删除。
注意：如果流收集器接口的内存已满，则该接口可能会丢弃传入数据包。
流收集器接口将处理后的信息文件成功传送到 FTP 服务器后，您可以分析该文件。该文件包含有关由流收集器接口收集和处理的流的详细信息。 表 2 说明了流收集器接口文件中可用的各种字段。
田 |
解释 |
|---|---|
linkDir |
链路目录 - 用于识别记录的随机生成的编号 |
分析器地址 |
分析器地址 |
分析器 ID |
分析器标识符 |
ifAlias |
接口标识符 |
源地址 |
源地址 |
目标地址 |
目标地址 |
包 |
数据包数 |
字节 |
字节数 |
开始时间 |
开始时间 |
结束时间 |
结束时间 |
源端口 |
源端口 |
目标端口 |
目标端口 |
tcp_flag |
TCP 标志 |
协议 |
IP 协议编号 |
src_AS_number |
源 AS 编号 |
dst_AS_number |
目标 AS 编号 |
以下是流收集器接口文件输出的示例：
11799241612374557782|10.10.10.1|server1|at_4_0_0_4|192.168.10.100|10.0.0.1|8| 3136|1077926402|1077926402|8224|12336|27|6|0|0