Juniper EX (sFlow)

Check against your release

This guide follows Juniper’s documentation and has been tested on an EX4300. Check every statement against the documentation for your Junos release; lines marked check on your release weren’t shown verbatim there.

Heimnull receives sFlow v5 on UDP 6343 by default (HN_SFLOW_PORT). Each flow sample is one sampled packet: Heimnull reads its header (addresses, ports, protocol, TCP flags, fragments, VLAN), the sampling rate carried in the sample, and the input and output ifIndex. Counter samples are ignored, because interface counters come from SNMP.

The examples use Heimnull at 10.0.0.10 and the switch at 10.0.0.4.

Configuration

set protocols sflow collector 10.0.0.10 udp-port 6343
set protocols sflow agent-id 10.0.0.4
set protocols sflow sample-rate ingress 2048
set protocols sflow polling-interval 0
set protocols sflow interfaces ge-0/0/47.0
set protocols sflow interfaces ge-0/0/46.0

• collector is the Heimnull host. The EX allows up to 4 collectors. The default UDP port is 6343.
• agent-id is a stable address for the switch. Heimnull identifies the exporter by the source address of the UDP datagrams, so keep that address stable too: the switch sends from the interface that routes to the collector. Check on your release whether source-ip under [edit protocols sflow] lets you set it.
• sample-rate ingress N samples 1 in N packets entering the interface, for N from 1 to 1,073,741,823. The bare-number form was removed in Junos 10.4 for EX. Setting only egress turns ingress sampling off. Interface-level settings override the global ones.
• interfaces are the uplinks or customer-facing ports whose traffic Heimnull should see. Not Layer 3 VLAN-tagged interfaces, and not ae bundles: configure the member links.
• polling-interval 0 turns counter samples off. Heimnull doesn’t use them.

Pick the sample rate from the traffic

The EX samples at most 300 packets per second per FPC, and Juniper documents that limit as not configurable. Above it, samples are dropped, and every rate Heimnull computes reads low. So pick N from the traffic, not from a default:

Traffic on the line card	Packets per second (700-byte average)	1 in N for under 300 samples/s
1 Gbit/s	about 180,000	1 in 1024
10 Gbit/s	about 1.8 million	1 in 8192 (about 220 samples/s)

Use the same rate on every port of a line card, as Juniper recommends. Heimnull reads the rate from every sample, so there’s nothing to set on its side.

Which direction to sample

Sample one direction per link, at the edge: ingress on uplinks sees traffic entering your network, and ingress on the switch’s other ports sees the reverse. Sampling both ingress and egress on the same path counts each packet twice.

In Heimnull

1. The switch appears under Configure → Exporters when its first datagram arrives. Approve it, unless new exporters are approved automatically.
2. Give the switch’s interfaces roles under Configure → Interface settings: the uplinks as Transit (or Peering), the other ports as Internal. ifIndex values come from the samples; add SNMP on the exporter to get their names.
3. The sampling rate shows as detected on the exporter.

sFlow samples are packet samples, like a Juniper MX’s inline monitoring: they arrive within a second or two, so the Live page shows per-second detail and detection reacts in about 5.5 seconds.

A switch has no BGP to take mitigation routes. Heimnull’s blackholes and FlowSpec rules go to the routers behind it.

Check it

On the switch (check the commands on your release):

• show sflow: sampling rates, polling interval and agent ID
• show sflow interface: per-interface rates
• show sflow collector: samples sent to each collector

In Heimnull, System shows the exporter’s datagrams, records and packet samples, and Live can be filtered by the exporter.

Sources: Juniper, “Example: Configure sFlow Technology to Monitor Network Traffic” (EX Series), the sample-rate and agent-id statement references, and “Configuring sFlow Technology for Network Monitoring (CLI Procedure)”.