• Flow server shows KB throughput vs ge-0/0/0 sustained 1GB/24hr with 10GB spikes

• Interface ge-0/0/0 shows sustained 1GB/24hr with 10GB spikes via show interfaces extensive.
• J-Flow v9 collector reports only kilobytes despite sampling rate adjustments.
• ICMP flows visible after lowering sample rate from 1000 to 100; iperf still underreported at KB levels.
• vSRX shows heavy PMI counter increments via show security flow pmi statistics

• Disabled PowerMode IPsec (PMI) and J-Flow v9 reported correct GB-level throughput
• PowerMode IPsec (PMI) enabled by default on vSRX platforms (security flow power-mode-ipsec).PMI enabled on vSRX bypasses standard flow engine via optimized Vector Packet Processing + AES-NI path in PFE.
• Sessions handled by PMI (or Services Offload) disable inline active flow monitoring.
• Inline active flow monitoring acts on a flow with respect to session. When services offload (SOF), PMI, or both are enabled for a given session, inline active flow monitoring is not supported for that session.
• If a session is handled by PMI or SOF, then inline active flow monitoring is disabled for that flow

https://www.juniper.net/documentation/us/en/software/junos/flow-monitoring/topics/concept/services-ipfix-flow-template-flow-aggregation-configuring.html

https://www.juniper.net/documentation/us/en/software/junos/vpn-ipsec/topics/topic-map/security-powermode-ipsec-vpn.html