This article describes RE-based sampled traffic behavior in the following situations:
When a mix of MPC and DPC cards is used.
When input/output sampling is configured on an interface (no firewall sampling filter is enabled).
Note: When traffic ingresses from an MPC and egresses on a DPC, sampling will not work if no firewall-filter is configured. (This situation is described in the test cases presented below.)
IXIA----(MPC)(ge-4/2/0)----R1----(ge-3/3/8)----DPC-----(ge-1/3/8)-R2-(ge-3/3/9)----IXIA |(ge-3/3/2) | | | FLOW SERVER
lab@R1# show interfaces ge-3/3/8 unit 0 { family inet { sampling { input; output; } address 192.168.10.1/24; } } lab@R1# show interfaces ge-4/2/0 unit 0 { family inet { sampling { input; } address 192.168.20.1/24; } } lab@R1# show forwarding-options sampling { input { rate 1; } family inet { output { file filename sampling-test size 2m world-readable; flow-server 192.168.30.1 { port 5005; local-dump; source-address 192.168.30.2; version 5; } } } }
Test Case 1
Failure Scenario Sampling output configured on ge-3/3/8 in output.
Traffic ingressing on ge-4/2/0(MPC) and egressing on ge-3/3/8(DPC).
++++++++++ lab@R1# show interfaces ge-3/3/8 unit 0 { family inet { sampling { inactive: input; output; } address 192.168.10.1/24; } } lab@R1# show interfaces ge-4/2/0 unit 0 { family inet { inactive: sampling { input; } address 192.168.20.1/24; } } lab@R1# show forwarding-options sampling { input { rate 1; } family inet { output { file filename sampling-test size 2m world-readable; flow-server 192.168.30.1 { port 5005; local-dump; source-address 192.168.30.2; version 5; } } } } ++++++++++++++ [edit] lab@MX-480 # run show log /var/tmp/sampling-test # Oct 4 11:15:42 # Dest Src Dest Src Proto TOS Pkt Intf IP TCP # addr addr port port len num frag flags [edit] +++++++++++
Observation: No CFLOWD (sampling) packets are logged.
+++++++++Monitor traffic of the Flow-server interface does not send any UDP packet matching port 5005 +++++++++++++ 11:16:07.584706 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:16:07.932453 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:16:16.847689 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:16:17.775200 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:16:24.727825 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:16:25.484418 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:16:32.593919 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:16:34.560321 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:16:40.909137 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:16:44.283097 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:16:49.493033 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:16:52.500181 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:16:57.479648 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:17:02.470886 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 +++++++++++++++
Observation: Only the control packet is sent out for OSPFs. No CFLOWD (sampling) packets are exported or sent out to the collector.
++++++++PFE verification on DPC+++++++ lab@R1# show interfaces ge-3/3/8 unit 0 { family inet { sampling { inactive: input; output; } address 192.168.10.1/24; } } +++++++++++++++++++++++++++++++++ [edit] lab@R1 # run start shell pfe network fpc3 ADPC platform (1200Mhz MPC 8548 processor, 1024MB memory, 512KB flash) ADPC3( vty)# show sample summary Sampling statistics summary: Max allowed samples per second: 1000 Cumulative statistics: Total samples accepted: 10 <<<< No increase Total samples dropped: 0 Statistics for the last second: Samples accepted: 1 Samples dropped: 0 ADPC3( vty)# show sample summary Sampling statistics summary: Max allowed samples per second: 1000 Cumulative statistics: Total samples accepted: 10 <<<< No increase Total samples dropped: 0 Statistics for the last second: Samples accepted: 1 Samples dropped: 0 ADPC3( vty)# show sample summary Sampling statistics summary: Max allowed samples per second: 1000 Cumulative statistics: Total samples accepted: 10 <<<< No increase Total samples dropped: 0 Statistics for the last second: Samples accepted: 1 Samples dropped: 0 ++++++++++++++++++++++++++++++
Observation: The sampling statistics do not increase, indicating that sampling is not working when traffic ingresses on MPC interfaces and egresses on DPC interfaces. The PFE statistics for sampling do not increase. Test Case 2
Traffic Ingressing on DPC and egressing on MPC.
+++++++++++++++ lab@R1# show interfaces ge-4/2/0 unit 0 { family inet { sampling { output; } address 192.168.20.1/24; } } lab@R1# show interfaces ge-3/3/8 unit 0 { family inet { address 192.168.10.1/24; } } [edit] lab@R1 # run show log /var/tmp/sampling-test # Oct 4 11:15:42 # Dest Src Dest Src Proto TOS Pkt Intf IP TCP # addr addr port port len num frag flags 200.168.10.2 202.168.10.2 63 63 17 0x0 46 354 0x0 0x0 200.168.10.2 202.168.10.2 63 63 17 0x0 46 354 0x0 0x0 200.168.10.2 202.168.10.2 63 63 17 0x0 46 354 0x0 0x0 ---(more)---[abort] [edit] lab@R1 # run show interfaces extensive ge-3/3/8 | match snmp Interface index: 231, SNMP ifIndex: 1479, Generation: 234 Interface flags: SNMP-Traps Internal: 0x4000 Logical interface ge-3/3/8.0 (Index 354) (SNMP ifIndex 2400) (Generation 179) Flags: SNMP-Traps 0x4004000 Encapsulation: ENET2 +++++++++++++++++++++ +++++++++Monitor traffic++++++++ 11:49:27.722085 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:49:30.400193 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:49:35.987052 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:49:37.911452 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:49:45.779863 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:49:46.959370 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:49:55.687352 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:49:55.702455 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:49:57.080224 Out 2c:6b:f5:4c:24:d6 > 2c:6b:f5:4c:24:d7, ethertype IPv4 (0x0800), length 74: truncated-ip - 40 bytes missing! 192.168.30.2.51210 > 192.168.30.1.5005: UDP, length 72<<<<<<<<<CFLOWD 11:51:21.895454 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:51:29.139973 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:51:29.783609 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:51:37.551837 Out 2c:6b:f5:4c:24:d6 > 01:00:5e:00:00:05, ethertype IPv4 (0x0800), length 74: truncated-ip - 20 bytes missing! 192.168.30.2 > 224.0.0.5: OSPFv2, Hello, length 60 11:51:38.616721 In PFE proto 2 (ipv4): 192.168.30.1 > 224.0.0.5: OSPFv2, Hello, length 60 11:51:39.714909 Out 2c:6b:f5:4c:24:d6 > 2c:6b:f5:4c:24:d7, ethertype IPv4 (0x0800), length 74: truncated-ip - 40 bytes missing! 192.168.30.2.53758 > 192.168.30.1.5005: UDP, length 72>>>>>>>>>>>CFLOWD 11:51:39.715313 In PFE proto 2 (ipv4): 192.168.30.1 > 192.168.30.2: ICMP 192.168.30.1 udp port 5005 unreachable, length 36 ++++++++PFE verification MPC+++++++++ NPC4( vty)# show sample summary Sampling statistics summary: Max allowed samples per second: 1000 Cumulative statistics: Total samples accepted: 3425651 <<<< Increase Total samples dropped: 22716 Statistics for the last second: Samples accepted: 686 Samples dropped: 0 NPC4( vty)# show sample summary Sampling statistics summary: Max allowed samples per second: 1000 Cumulative statistics: Total samples accepted: 3426610 <<<< Increase Total samples dropped: 22719 Statistics for the last second: Samples accepted: 645 Samples dropped: 0 ++++++++++++++++++++++++++
Observation: PFE statistics for sampling increases. Sampling works for transit traffic from DPC to MPC. <no in="" enet2="" ifindex="" logical="" snmp-traps="" interface="" snmp="" match="" extensive="" flags="" frag="" num="" len="" port="" addr="" tcp="" ip="" intf="" pkt="" tos="" proto="" src="" dest="" oct="" sampling-test="" tmp="" var="" log="" run="" ge-3="" address="" inet="" family="" unit="" ge-4="" interfaces="" mpc.="" egressing="" ingressing="" test="" increase.="" doesnt="" pfe="" interfaces.="" dpc="" egress="" and="" mpc="" ingress="" traffic="" when="" working="" is="" indicating="" not="" does="" seen="" as="" cumulative="" per="" allowed="" max="" sampling="" summary="" sample="" show="" last="" the="" for="" statistics="" samples="" total="" increase=""> <cflowd out="">
In order to make the sampling capture the flow packets, use an egress filter on the interface over which traffic is moving, then apply it to the respective interfaces, as in the examples below:
lab@R1# show firewall filter sam term 1 { then { count sampling-cnt; sample; } } +++++++Example Filter applied on the interfaces++++++ lab@R1# show interfaces ge-3/3/8 unit 0 { family inet { filter { input sam; output sam; } address 192.168.10.1/24; } } +++++++++++++++++