Ethernet Switching
Highlighted
Ethernet Switching

ex4200 and sflow issue

‎12-19-2019 12:48 AM
Hello, we have enable sflow to send flows to our fastnetmon but we faced an issue. we generate 500mbps udp towards a /32 on our network but sflow send 200mbps flows to fastnetmon thus it can not detect attacked ips correctly. this is our sflow config sFlow : Enabled Sample limit : 300 packets/second Polling interval : 20 second Sample rate egress : 1:2048: Disabled Sample rate ingress : 1:2048: Disabled Agent ID : 1xxxx Source IP address : 1xxxxx collector yyyyy { udp-port 6343; } interfaces xe-0/1/0.0 { sample-rate ingress 1000; } interfaces xe-0/1/2.0 { sample-rate ingress 1000; } Thank you.
3 REPLIES 3
Highlighted
Ethernet Switching

Re: ex4200 and sflow issue

‎12-19-2019 01:30 AM

Hi Blackmetal,

 

Can you please share the configuration in entirety and more readable format?

Also, do you have sFlow enabled on any other device? If yes, do you see any similar problem there?

 

//Nex

 

 

Highlighted
Ethernet Switching

Re: ex4200 and sflow issue

‎12-19-2019 01:35 AM

Hi,

this is 

polling-interval 20;
sample-rate ingress 2000;
collector x.x.x.x. {
udp-port 6343;
}
interfaces xe-0/1/0.0 {
sample-rate ingress 2000;
}
interfaces xe-0/1/2.0 {
sample-rate ingress 2000;
}

Highlighted
Ethernet Switching

Re: ex4200 and sflow issue

‎12-19-2019 01:45 AM

Hello,

 

EX4200 can NOT send "200Mbps" to the collector because sFlow protocol does not have an information element for flow Mbps/rate/bandwidth/whatever You call it

https://sflow.org/sflow_version_5.txt

It's collector's job to figure out what is the BW/rate for a given flow, using "Sampling rate" and packet length information elements (posibly averaging over several pkt length values if packet lengths differ).

HTH

Thx

Alex

 

 

_____________________________________________________________________

Please ask Your Juniper account team about Juniper Professional Services offerings.
Juniper PS can design, test & build the network/part of the network as per Your requirements

+++++++++++++++++++++++++++++++++++++++++++++

Accept as Solution = cool !
Accept as Solution+Kudo = You are a Star !
Feedback