| Table of Contents |
|---|
Netflow Daemon Listening UDP Port
...
| Code Block | ||
|---|---|---|
| ||
! this command is optional, this will flow data about in-progress flows, very handy for large file transfers. ip flow-cache timeout active 1 ! version can be 5 or 9 with 9 add IPV4 template ip flow-export version 5 ip flow-export destination <opflow_server> 123459995 ! interface FastEthernet0/0 !only if you want output traffic ip flow ingress !only if you want input traffic ip flow egress |
...
Sample Juniper J-Flow Configuration for SRX
...
| Code Block |
|---|
interfaces {
ge-0/0/0 {
unit 0 {
family inet {
sampling {
input;
output;
forwarding-options {
sampling {
input {
rate 100;
#### This means 1 in every 100 packets is sampled DO NOT reduce this to 1 unless the router is very lightly loaded.
}
family inet {
output {
flow-server 192.168.1.1 {
port 12345;
version 5;
### Version 5 is simplest but only supports IPV4
}
}
}
}
} |
J-FLow version 9
J-FLow version 9 supports other protocols such as IPV6 and MPLS . To get good results we recommend you still only use a template for IPV4 with Version 9. There are some subtle differences with the SRX models for the config so please refer to J-Flow SRX version 9 Config Examples
...
On the interface you want to collect flow traffic from, add:
...
ip flow ingressip flow egress |
Now that you have an interface setup to gather netflow information you have to tell the router to send it somewhere:
ip flow-export version 9# replace the ip address in the following line with your VM's ip addressip flow-export destination 192.168.0.10 12345 |
If you enable that configuration netflow traffic should now be sent to your VM.
By default netflow will send information about flows after they are finished, if you would like to see information more often you can set the flow-cache timeout, in minutes, so this will send flow info every minute (see the docs for more details):
ip flow-cache timeout active 1 |
opFlow will now be displaying your data! Visit http://<vm_ip_address>/cgi-omk/opFlow.pl and take a look! (also make sure you have a license)
...