The Jflow_v9 template was modified in Junos 17.1R1 and 17.3R1. This article explains these template changes.
In 17.1R1, the length of the fields, PKTS and BYTES changed from 4 bytes to 8 bytes.
In 17.3R1, the sampling interval field of option data moved from " system scope " to " template scope ".
In regards to the jflow_v9 template, there are two field changes between 15.1R7.9 and 19.3R1.8
No. Time Source Destination Protocol Length Info 1 0.000000 172.16.0.1 192.168.0.2 CFLOW 166 total: 1 (v9) record Obs-Domain-ID= 6 [Data-Template:256]Frame 1: 166 bytes on wire (1328 bits), 166 bytes captured (1328 bits)Juniper EthernetInternet Protocol Version 4, Src: 172.16.0.1, Dst: 192.168.0.2User Datagram Protocol, Src Port: 33092, Dst Port: 2055Cisco NetFlow/IPFIX Version: 9 Count: 1 SysUptime: 59.565000000 seconds Timestamp: Sep 26, 2019 17:04:25.000000000 Tokyo Standard Time FlowSequence: 3 SourceId: 6 FlowSet 1 [id=0] (Data Template): 256 FlowSet Id: Data Template (V9) (0) FlowSet Length: 92 Template (Id = 256, Count = 21) Template Id: 256 Field Count: 21 Field (1/21): IP_SRC_ADDR Type: IP_SRC_ADDR (8) Length: 4 Field (2/21): IP_DST_ADDR Type: IP_DST_ADDR (12) Length: 4 Field (3/21): IP_TOS Type: IP_TOS (5) Length: 1 Field (4/21): PROTOCOL Type: PROTOCOL (4) Length: 1 Field (5/21): L4_SRC_PORT Type: L4_SRC_PORT (7) Length: 2 Field (6/21): L4_DST_PORT Type: L4_DST_PORT (11) Length: 2 Field (7/21): ICMP_TYPE Type: ICMP_TYPE (32) Length: 2 Field (8/21): INPUT_SNMP Type: INPUT_SNMP (10) Length: 4 Field (9/21): SRC_AS Type: SRC_AS (16) Length: 4 Field (10/21): DST_AS Type: DST_AS (17) Length: 4 Field (11/21): BGP_NEXT_HOP Type: BGP_NEXT_HOP (18) Length: 4 Field (12/21): OUTPUT_SNMP Type: OUTPUT_SNMP (14) Length: 4 Field (13/21): BYTES Type: BYTES (1) Length: 4 Field (14/21): PKTS Type: PKTS (2) Length: 4 Field (15/21): FIRST_SWITCHED Type: FIRST_SWITCHED (22) Length: 4 Field (16/21): LAST_SWITCHED Type: LAST_SWITCHED (21) Length: 4 Field (17/21): IP_NEXT_HOP Type: IP_NEXT_HOP (15) Length: 4 Field (18/21): SRC_MASK Type: SRC_MASK (9) Length: 1 Field (19/21): DST_MASK Type: DST_MASK (13) Length: 1 Field (20/21): TCP_FLAGS Type: TCP_FLAGS (6) Length: 1 Field (21/21): IP_PROTOCOL_VERSION Type: IP_PROTOCOL_VERSION (60) Length: 1No. Time Source Destination Protocol Length Info 2 0.000012 172.16.0.1 192.168.0.2 CFLOW 98 total: 1 (v9) record Obs-Domain-ID= 6 [Options-Template:257]Frame 2: 98 bytes on wire (784 bits), 98 bytes captured (784 bits)Juniper EthernetInternet Protocol Version 4, Src: 172.16.0.1, Dst: 192.168.0.2User Datagram Protocol, Src Port: 33092, Dst Port: 2055Cisco NetFlow/IPFIX Version: 9 Count: 1 SysUptime: 59.565000000 seconds Timestamp: Sep 26, 2019 17:04:25.000000000 Tokyo Standard Time FlowSequence: 4 SourceId: 6 FlowSet 1 [id=1] (Options Template): 257 FlowSet Id: Options Template(V9) (1) FlowSet Length: 24 Options Template (Id = 257) (Scope Count = 1; Data Count = 2) Template Id: 257 Option Scope Length: 4 Option Length: 8 Field (1/1) [Scope]: Template Scope Type: Template (5) Length: 2 Field (1/2): FLOW_ACTIVE_TIMEOUT Type: FLOW_ACTIVE_TIMEOUT (36) Length: 2 Field (2/2): FLOW_INACTIVE_TIMEOUT Type: FLOW_INACTIVE_TIMEOUT (37) Length: 2 Padding: 0000No. Time Source Destination Protocol Length Info 3 0.000018 172.16.0.1 192.168.0.2 CFLOW 98 total: 1 (v9) record Obs-Domain-ID= 6 [Options-Template:258]Frame 3: 98 bytes on wire (784 bits), 98 bytes captured (784 bits)Juniper EthernetInternet Protocol Version 4, Src: 172.16.0.1, Dst: 192.168.0.2User Datagram Protocol, Src Port: 33092, Dst Port: 2055Cisco NetFlow/IPFIX Version: 9 Count: 1 SysUptime: 59.565000000 seconds Timestamp: Sep 26, 2019 17:04:25.000000000 Tokyo Standard Time FlowSequence: 5 SourceId: 6 FlowSet 1 [id=1] (Options Template): 258 FlowSet Id: Options Template(V9) (1) FlowSet Length: 24 Options Template (Id = 258) (Scope Count = 1; Data Count = 2) Template Id: 258 Option Scope Length: 4 Option Length: 8 Field (1/1) [Scope]: System Scope Type: System (1) Length: 4 Field (1/2): SAMPLING_INTERVAL Type: SAMPLING_INTERVAL (34) Length: 4 Field (2/2): SAMPLING_ALGORITHM Type: SAMPLING_ALGORITHM (35) Length: 1 Padding: 0000
No. Time Source Destination Protocol Length Info 1 0.000000 172.16.0.1 192.168.0.2 CFLOW 166 total: 1 (v9) record Obs-Domain-ID= 6 [Data-Template:256]Frame 1: 166 bytes on wire (1328 bits), 166 bytes captured (1328 bits)Juniper EthernetInternet Protocol Version 4, Src: 172.16.0.1, Dst: 192.168.0.2User Datagram Protocol, Src Port: 33092, Dst Port: 2055Cisco NetFlow/IPFIX Version: 9 Count: 1 SysUptime: 80.223000000 seconds Timestamp: Sep 26, 2019 16:27:37.000000000 Tokyo Standard Time FlowSequence: 64 SourceId: 6 FlowSet 1 [id=0] (Data Template): 256 FlowSet Id: Data Template (V9) (0) FlowSet Length: 92 Template (Id = 256, Count = 21) Template Id: 256 Field Count: 21 Field (1/21): IP_SRC_ADDR Type: IP_SRC_ADDR (8) Length: 4 Field (2/21): IP_DST_ADDR Type: IP_DST_ADDR (12) Length: 4 Field (3/21): IP_TOS Type: IP_TOS (5) Length: 1 Field (4/21): PROTOCOL Type: PROTOCOL (4) Length: 1 Field (5/21): L4_SRC_PORT Type: L4_SRC_PORT (7) Length: 2 Field (6/21): L4_DST_PORT Type: L4_DST_PORT (11) Length: 2 Field (7/21): ICMP_TYPE Type: ICMP_TYPE (32) Length: 2 Field (8/21): INPUT_SNMP Type: INPUT_SNMP (10) Length: 4 Field (9/21): SRC_AS Type: SRC_AS (16) Length: 4 Field (10/21): DST_AS Type: DST_AS (17) Length: 4 Field (11/21): BGP_NEXT_HOP Type: BGP_NEXT_HOP (18) Length: 4 Field (12/21): OUTPUT_SNMP Type: OUTPUT_SNMP (14) Length: 4 Field (13/21): BYTES Type: BYTES (1) Length: 8 Field (14/21): PKTS Type: PKTS (2) Length: 8 Field (15/21): FIRST_SWITCHED Type: FIRST_SWITCHED (22) Length: 4 Field (16/21): LAST_SWITCHED Type: LAST_SWITCHED (21) Length: 4 Field (17/21): IP_NEXT_HOP Type: IP_NEXT_HOP (15) Length: 4 Field (18/21): SRC_MASK Type: SRC_MASK (9) Length: 1 Field (19/21): DST_MASK Type: DST_MASK (13) Length: 1 Field (20/21): TCP_FLAGS Type: TCP_FLAGS (6) Length: 1 Field (21/21): IP_PROTOCOL_VERSION Type: IP_PROTOCOL_VERSION (60) Length: 1No. Time Source Destination Protocol Length Info 2 0.000010 172.16.0.1 192.168.0.2 CFLOW 102 total: 1 (v9) record Obs-Domain-ID= 6 [Options-Template:257]Frame 2: 102 bytes on wire (816 bits), 102 bytes captured (816 bits)Juniper EthernetInternet Protocol Version 4, Src: 172.16.0.1, Dst: 192.168.0.2User Datagram Protocol, Src Port: 33092, Dst Port: 2055Cisco NetFlow/IPFIX Version: 9 Count: 1 SysUptime: 80.223000000 seconds Timestamp: Sep 26, 2019 16:27:37.000000000 Tokyo Standard Time FlowSequence: 65 SourceId: 6 FlowSet 1 [id=1] (Options Template): 257 FlowSet Id: Options Template(V9) (1) FlowSet Length: 28 Options Template (Id = 257) (Scope Count = 1; Data Count = 3) Template Id: 257 Option Scope Length: 4 Option Length: 12 Field (1/1) [Scope]: Template Scope Type: Template (5) Length: 2 Field (1/3): FLOW_ACTIVE_TIMEOUT Type: FLOW_ACTIVE_TIMEOUT (36) Length: 2 Field (2/3): FLOW_INACTIVE_TIMEOUT Type: FLOW_INACTIVE_TIMEOUT (37) Length: 2 Field (3/3): SAMPLING_INTERVAL Type: SAMPLING_INTERVAL (34) Length: 4 Padding: 0000No. Time Source Destination Protocol Length Info 3 0.000015 172.16.0.1 192.168.0.2 CFLOW 94 total: 1 (v9) record Obs-Domain-ID= 6 [Options-Template:258]Frame 3: 94 bytes on wire (752 bits), 94 bytes captured (752 bits)Juniper EthernetInternet Protocol Version 4, Src: 172.16.0.1, Dst: 192.168.0.2User Datagram Protocol, Src Port: 33092, Dst Port: 2055Cisco NetFlow/IPFIX Version: 9 Count: 1 SysUptime: 80.223000000 seconds Timestamp: Sep 26, 2019 16:27:37.000000000 Tokyo Standard Time FlowSequence: 66 SourceId: 6 FlowSet 1 [id=1] (Options Template): 258 FlowSet Id: Options Template(V9) (1) FlowSet Length: 20 Options Template (Id = 258) (Scope Count = 1; Data Count = 1) Template Id: 258 Option Scope Length: 4 Option Length: 4 Field (1/1) [Scope]: System Scope Type: System (1) Length: 4 Field (1/1): SAMPLING_ALGORITHM Type: SAMPLING_ALGORITHM (35) Length: 1 Padding: 0000
There are two Jflow_v9 template updates implemented in Junos 17.1R1 and 17.3R1.
In 17.1R1, support for export of "data template" and "option template" is added in V9 format for IPV4 and IPV6 families. To achieve this, there is a new export entry data structure for IPFIX format. The size of the fields: flow packets and flow bytes changed from 4 byte to 8 bytes in V9 format.
In 17.3R1, the Sampling Interval field is part of the "ScopeTemplate" field in the Option template records instead of the "ScopeSystem" field for PIC-based J-Flow of MX Series and inline J-Flow of PTX Series Routers. Family level sampling rate config is supported for Jflow. The sampling interval field of option data moved from "system scope" to "template scope". So, Jflow collectors can decode sampling interval for different families.