Support Support Downloads Knowledge Base Juniper Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

Jflow_v9 template changes implemented in Junos 17.1R1 and 17.3R1

0

0

Article ID: KB35179 KB Last Updated: 30 Oct 2019Version: 1.0
Summary:

The Jflow_v9 template was modified in Junos 17.1R1 and 17.3R1. This article explains these template changes.

In 17.1R1, the length of the fields, PKTS and BYTES changed from 4 bytes to 8 bytes.

In 17.3R1, the sampling interval field of option data moved from "system scope" to "template scope".

Symptoms:

In regards to the jflow_v9 template, there are two field changes between 15.1R7.9 and 19.3R1.8

MX@15.1R7.9 jflow_v9

No.     Time           Source                Destination           Protocol Length Info
      1 0.000000       1.1.1.1               192.168.0.2           CFLOW    166    total: 1 (v9) record Obs-Domain-ID=    6 [Data-Template:256]

Frame 1: 166 bytes on wire (1328 bits), 166 bytes captured (1328 bits)
Juniper Ethernet
Internet Protocol Version 4, Src: 1.1.1.1, Dst: 192.168.0.2
User Datagram Protocol, Src Port: 33092, Dst Port: 2055
Cisco NetFlow/IPFIX
    Version: 9
    Count: 1
    SysUptime: 59.565000000 seconds
    Timestamp: Sep 26, 2019 17:04:25.000000000 Tokyo Standard Time
    FlowSequence: 3
    SourceId: 6
    FlowSet 1 [id=0] (Data Template): 256
        FlowSet Id: Data Template (V9) (0)
        FlowSet Length: 92
        Template (Id = 256, Count = 21)
            Template Id: 256
            Field Count: 21
            Field (1/21): IP_SRC_ADDR
                Type: IP_SRC_ADDR (8)
                Length: 4
            Field (2/21): IP_DST_ADDR
                Type: IP_DST_ADDR (12)
                Length: 4
            Field (3/21): IP_TOS
                Type: IP_TOS (5)
                Length: 1
            Field (4/21): PROTOCOL
                Type: PROTOCOL (4)
                Length: 1
            Field (5/21): L4_SRC_PORT
                Type: L4_SRC_PORT (7)
                Length: 2
            Field (6/21): L4_DST_PORT
                Type: L4_DST_PORT (11)
                Length: 2
            Field (7/21): ICMP_TYPE
                Type: ICMP_TYPE (32)
                Length: 2
            Field (8/21): INPUT_SNMP
                Type: INPUT_SNMP (10)
                Length: 4
            Field (9/21): SRC_AS
                Type: SRC_AS (16)
                Length: 4
            Field (10/21): DST_AS
                Type: DST_AS (17)
                Length: 4
            Field (11/21): BGP_NEXT_HOP
                Type: BGP_NEXT_HOP (18)
                Length: 4
            Field (12/21): OUTPUT_SNMP
                Type: OUTPUT_SNMP (14)
                Length: 4
            Field (13/21): BYTES
                Type: BYTES (1)
                Length: 4
            Field (14/21): PKTS
                Type: PKTS (2)
                Length: 4 
            Field (15/21): FIRST_SWITCHED
                Type: FIRST_SWITCHED (22)
                Length: 4
            Field (16/21): LAST_SWITCHED
                Type: LAST_SWITCHED (21)
                Length: 4
            Field (17/21): IP_NEXT_HOP
                Type: IP_NEXT_HOP (15)
                Length: 4
            Field (18/21): SRC_MASK
                Type: SRC_MASK (9)
                Length: 1
            Field (19/21): DST_MASK
                Type: DST_MASK (13)
                Length: 1
            Field (20/21): TCP_FLAGS
                Type: TCP_FLAGS (6)
                Length: 1
            Field (21/21): IP_PROTOCOL_VERSION
                Type: IP_PROTOCOL_VERSION (60)
                Length: 1

No.     Time           Source                Destination           Protocol Length Info
      2 0.000012       1.1.1.1               192.168.0.2           CFLOW    98     total: 1 (v9) record Obs-Domain-ID=    6 [Options-Template:257]

Frame 2: 98 bytes on wire (784 bits), 98 bytes captured (784 bits)
Juniper Ethernet
Internet Protocol Version 4, Src: 1.1.1.1, Dst: 192.168.0.2
User Datagram Protocol, Src Port: 33092, Dst Port: 2055
Cisco NetFlow/IPFIX
    Version: 9
    Count: 1
    SysUptime: 59.565000000 seconds
    Timestamp: Sep 26, 2019 17:04:25.000000000 Tokyo Standard Time
    FlowSequence: 4
    SourceId: 6
    FlowSet 1 [id=1] (Options Template): 257
        FlowSet Id: Options Template(V9) (1)
        FlowSet Length: 24
        Options Template (Id = 257) (Scope Count = 1; Data Count = 2)
            Template Id: 257
            Option Scope Length: 4
            Option Length: 8
            Field (1/1) [Scope]: Template
                Scope Type: Template (5)
                Length: 2
            Field (1/2): FLOW_ACTIVE_TIMEOUT
                Type: FLOW_ACTIVE_TIMEOUT (36)
                Length: 2
            Field (2/2): FLOW_INACTIVE_TIMEOUT
                Type: FLOW_INACTIVE_TIMEOUT (37)
                Length: 2
        Padding: 0000

No.     Time           Source                Destination           Protocol Length Info
      3 0.000018       1.1.1.1               192.168.0.2           CFLOW    98     total: 1 (v9) record Obs-Domain-ID=    6 [Options-Template:258]

Frame 3: 98 bytes on wire (784 bits), 98 bytes captured (784 bits)
Juniper Ethernet
Internet Protocol Version 4, Src: 1.1.1.1, Dst: 192.168.0.2
User Datagram Protocol, Src Port: 33092, Dst Port: 2055
Cisco NetFlow/IPFIX
    Version: 9
    Count: 1
    SysUptime: 59.565000000 seconds
    Timestamp: Sep 26, 2019 17:04:25.000000000 Tokyo Standard Time
    FlowSequence: 5
    SourceId: 6
    FlowSet 1 [id=1] (Options Template): 258
        FlowSet Id: Options Template(V9) (1)
        FlowSet Length: 24
        Options Template (Id = 258) (Scope Count = 1; Data Count = 2)
            Template Id: 258
            Option Scope Length: 4
            Option Length: 8
            Field (1/1) [Scope]: System
                Scope Type: System (1)
                Length: 4
            Field (1/2): SAMPLING_INTERVAL
                Type: SAMPLING_INTERVAL (34)
                Length: 4

            Field (2/2): SAMPLING_ALGORITHM
                Type: SAMPLING_ALGORITHM (35)
                Length: 1
        Padding: 0000


MX@19.3R1.8 jflow_v9

No.     Time           Source                Destination           Protocol Length Info
      1 0.000000       1.1.1.1               192.168.0.2           CFLOW    166    total: 1 (v9) record Obs-Domain-ID=    6 [Data-Template:256]

Frame 1: 166 bytes on wire (1328 bits), 166 bytes captured (1328 bits)
Juniper Ethernet
Internet Protocol Version 4, Src: 1.1.1.1, Dst: 192.168.0.2
User Datagram Protocol, Src Port: 33092, Dst Port: 2055
Cisco NetFlow/IPFIX
    Version: 9
    Count: 1
    SysUptime: 80.223000000 seconds
    Timestamp: Sep 26, 2019 16:27:37.000000000 Tokyo Standard Time
    FlowSequence: 64
    SourceId: 6
    FlowSet 1 [id=0] (Data Template): 256
        FlowSet Id: Data Template (V9) (0)
        FlowSet Length: 92
        Template (Id = 256, Count = 21)
            Template Id: 256
            Field Count: 21
            Field (1/21): IP_SRC_ADDR
                Type: IP_SRC_ADDR (8)
                Length: 4
            Field (2/21): IP_DST_ADDR
                Type: IP_DST_ADDR (12)
                Length: 4
            Field (3/21): IP_TOS
                Type: IP_TOS (5)
                Length: 1
            Field (4/21): PROTOCOL
                Type: PROTOCOL (4)
                Length: 1
            Field (5/21): L4_SRC_PORT
                Type: L4_SRC_PORT (7)
                Length: 2
            Field (6/21): L4_DST_PORT
                Type: L4_DST_PORT (11)
                Length: 2
            Field (7/21): ICMP_TYPE
                Type: ICMP_TYPE (32)
                Length: 2
            Field (8/21): INPUT_SNMP
                Type: INPUT_SNMP (10)
                Length: 4
            Field (9/21): SRC_AS
                Type: SRC_AS (16)
                Length: 4
            Field (10/21): DST_AS
                Type: DST_AS (17)
                Length: 4
            Field (11/21): BGP_NEXT_HOP
                Type: BGP_NEXT_HOP (18)
                Length: 4
            Field (12/21): OUTPUT_SNMP
                Type: OUTPUT_SNMP (14)
                Length: 4
            Field (13/21): BYTES
                Type: BYTES (1)
                Length: 8
            Field (14/21): PKTS
                Type: PKTS (2)
                Length: 8
            Field (15/21): FIRST_SWITCHED
                Type: FIRST_SWITCHED (22)
                Length: 4
            Field (16/21): LAST_SWITCHED
                Type: LAST_SWITCHED (21)
                Length: 4
            Field (17/21): IP_NEXT_HOP
                Type: IP_NEXT_HOP (15)
                Length: 4
            Field (18/21): SRC_MASK
                Type: SRC_MASK (9)
                Length: 1
            Field (19/21): DST_MASK
                Type: DST_MASK (13)
                Length: 1
            Field (20/21): TCP_FLAGS
                Type: TCP_FLAGS (6)
                Length: 1
            Field (21/21): IP_PROTOCOL_VERSION
                Type: IP_PROTOCOL_VERSION (60)
                Length: 1

No.     Time           Source                Destination           Protocol Length Info
      2 0.000010       1.1.1.1               192.168.0.2           CFLOW    102    total: 1 (v9) record Obs-Domain-ID=    6 [Options-Template:257]

Frame 2: 102 bytes on wire (816 bits), 102 bytes captured (816 bits)
Juniper Ethernet
Internet Protocol Version 4, Src: 1.1.1.1, Dst: 192.168.0.2
User Datagram Protocol, Src Port: 33092, Dst Port: 2055
Cisco NetFlow/IPFIX
    Version: 9
    Count: 1
    SysUptime: 80.223000000 seconds
    Timestamp: Sep 26, 2019 16:27:37.000000000 Tokyo Standard Time
    FlowSequence: 65
    SourceId: 6
    FlowSet 1 [id=1] (Options Template): 257
        FlowSet Id: Options Template(V9) (1)
        FlowSet Length: 28
        Options Template (Id = 257) (Scope Count = 1; Data Count = 3)
            Template Id: 257
            Option Scope Length: 4
            Option Length: 12
            Field (1/1) [Scope]: Template
                Scope Type: Template (5)
                Length: 2
            Field (1/3): FLOW_ACTIVE_TIMEOUT
                Type: FLOW_ACTIVE_TIMEOUT (36)
                Length: 2
            Field (2/3): FLOW_INACTIVE_TIMEOUT
                Type: FLOW_INACTIVE_TIMEOUT (37)
                Length: 2
            Field (3/3): SAMPLING_INTERVAL
                Type: SAMPLING_INTERVAL (34)
                Length: 4

        Padding: 0000

No.     Time           Source                Destination           Protocol Length Info
      3 0.000015       1.1.1.1               192.168.0.2           CFLOW    94     total: 1 (v9) record Obs-Domain-ID=    6 [Options-Template:258]

Frame 3: 94 bytes on wire (752 bits), 94 bytes captured (752 bits)
Juniper Ethernet
Internet Protocol Version 4, Src: 1.1.1.1, Dst: 192.168.0.2
User Datagram Protocol, Src Port: 33092, Dst Port: 2055
Cisco NetFlow/IPFIX
    Version: 9
    Count: 1
    SysUptime: 80.223000000 seconds
    Timestamp: Sep 26, 2019 16:27:37.000000000 Tokyo Standard Time
    FlowSequence: 66
    SourceId: 6
    FlowSet 1 [id=1] (Options Template): 258
        FlowSet Id: Options Template(V9) (1)
        FlowSet Length: 20
        Options Template (Id = 258) (Scope Count = 1; Data Count = 1)
            Template Id: 258
            Option Scope Length: 4
            Option Length: 4
            Field (1/1) [Scope]: System
                Scope Type: System (1)
                Length: 4
            Field (1/1): SAMPLING_ALGORITHM
                Type: SAMPLING_ALGORITHM (35)
                Length: 1
        Padding: 0000

 
Solution:

There are two Jflow_v9 template updates implemented in Junos 17.1R1 and 17.3R1.‚Äč

Length of PKTS/BYTES field

In 17.1R1,  support for export of "data template" and "option template" is added in V9 format for IPV4 and IPV6 families. To achieve this, there is a new export entry data structure for IPFIX format. The size of the fields: flow packets and flow bytes changed from 4 byte to 8 bytes in V9 format.

Sampling_interval field

In 17.3R1, the Sampling Interval field is part of the "ScopeTemplate" field in the Option template records instead of the "ScopeSystem" field for PIC-based J-Flow of MX Series and inline J-Flow of PTX Series Routers. Family level sampling rate config is supported for Jflow. The sampling interval field of option data moved from "system scope" to "template scope". So, Jflow collectors can decode sampling interval for different families.

Related Links

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search