Junos OS

Hi,

 

I am having a real problem getting sflow to send traffic out. everything seems enabled, collectors configured and routes to them working. After doing an ethernet capture on one of the collectors, no UDP traffic is being received on the configured ports at all which leads me to believe that the problem is elsewhere.

 

Question, how can i debug the sflow traffic or at least determine that it is being sent and out of which interface.

 

 

The advantage with system-generated traffic is that you could always use "monitor traffic interface <blah> size 1514 no-resolve matching <protocol and/or port>" to view/watch such traffic in realtime. Just pick the correct interface/logical unit and do this command from CLI.

I suggest to always use "size" because in recent JUNOS, packets monitored in this way are truncated by default.

Also, use "no-resolve" to skip unnecessary DNS resolution. Use "matching" as a last clause on the command line and pick carefully protocol/port to avoid output scrolling fast beyond your screen/buffer limits. The matching clause is standard tcpdump regex in double quotes.

Thanks,

 

I have tried this on the only two physical interfaces that are up and running (0/0/10.0 and 11.0) and can see traffic from the switch going out to various hosts including the ip of the collector which happens to be my pc, most of which is SSH as i am connected and testing. I can see nothing on any of the sflow ports thoug. really strange.

 

 

it possible that the process has died. it says enabled in the config.Is it possible i tis being sent from some virtual interface, loopback etc? Also, what is the syntax for the 'matching' option, cant seem to get it right

 

sFlow            : Enabled
Sample limit     : 300 packets/second
Polling interval : 20 second
Sample rate      : 1:2000

I seem to have resolved this.

 

I upgraded the software version from 9.3 to 9.5r2.7 rebooted and the traffic kicked in.

 

not sure if this was a dead process reinstated by reboot, an OS bug or config issue but its all good now.

 

A.