Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Example: Sampling Configuration for M, MX and T Series Routers

 
Figure 1: Active Flow Monitoring—Sampling Configuration Topology Diagram
Active Flow Monitoring—Sampling
Configuration Topology Diagram

In Figure 1, traffic from Router 1 arrives on the monitoring router's Gigabit Ethernet ge-2/3/0 interface. The exit interface on the monitoring router that leads to destination Router 2 is ge-3/0/0. In active flow monitoring, both the input interface and exit interface can be any interface type (such as SONET/SDH, Gigabit Ethernet, and so on). The export interface leading to the flow server is fe-1/0/0.

Configure a firewall filter to sample, count, and accept all traffic. Apply the filter to the input interface, and configure the exit interface (for traffic forwarding), the adaptive services interface (for flow processing), and the export interface (for exporting flow records).

Configure sampling at the [edit forwarding-options] hierarchy level. Include the IP address and port of the flow server with the flow-server statement and specify the adaptive services interface to be used for flow record processing with the interface statement at the [edit forwarding-options sampling] hierarchy level.

Router 1

Verifying Your Work

To verify that your configuration is correct, use the following commands on the monitoring station that is configured for active flow monitoring:

  • show services accounting errors

  • show services accounting (flow | flow-detail)

  • show services accounting memory

  • show services accounting packet-size-distribution

  • show services accounting status

  • show services accounting usage

  • show services accounting aggregation template template-name name (detail | extensive | terse) (version 9 only)

Most active flow monitoring operational mode commands contain equivalent output information to the following passive flow monitoring commands:

  • show services accounting errors = show passive-monitoring error

  • show services accounting flow = show passive-monitoring flow

  • show services accounting memory = show passive-monitoring memory

  • show services accounting status = show passive-monitoring status

  • show services accounting usage = show passive-monitoring usage

The active flow monitoring commands can be used with most active flow monitoring applications, including sampling, discard accounting, port mirroring, and multiple port mirroring. However, you can use the passive flow monitoring commands only with configurations that contain a monitoring group at the [edit forwarding-options monitoring] hierarchy level.

The following shows the output of the show commands used with the configuration example:

user@router1> show services accounting errors