Mailing List Archive

flow exports and next hops
I'm trying to collect some stats using the flow exports feature of JunOS
(5.5R2.3)
but have come across a problem.

The router is setting the 'next-hop' value in the flow packet to
'0.0.0.0' for
flows that are destined towards a nexthop at the other end of a
point-to-point
SONET link.

A 'show route' seems to give some clues as to the culprit:

> show route xxxx extensive

inet.0: 122127 destinations, 212622 routes (122123 active, 3 holddown, 1
hidden)
xxxx/32 (1 entry, 1 announced)
TSI:
KRT in-kernel xxxx/32 -> {so-0/0/0.0}
*OSPF Preference: 10
Next hop: via so-0/0/0.0, selected
State: <Active Int>
Local AS: 8737
Age: 6d 5:05:51 Metric: 4
Area: 0.0.0.0
Task: OSPF
Announcement bits (3): 0-KRT 4-Resolve inet.0 5-RT
AS path: I

The next hop here only shows an interface rather than an IP address, so
presumably
this is why the flow packets have 0.0.0.0 set for the next-hop.

Is there a way around this? My flow analysis software gets somewhat
confused
and not happy when given a zero-value next hop, and ideally i'd like to
see
either the remote ip address of the SONET link or the 'final' next-hop.

Thanks.
Ben
flow exports and next hops [ In reply to ]
This is actually the way we have implemented it as we treat internal
OSPF p2p interface as unnumbered in that case and therefor
the next-hop is 0.0.0.0. What you will have is the interface
index which should be good enough for your application to understand
where the flow was coming in. Below is an example.


Jun 10 13:49:27 v5 flow entry
Jun 10 13:49:27 Src addr: 12.8.8.8
Jun 10 13:49:27 Dst addr: 12.1.1.1
Jun 10 13:49:27 Nhop addr: 0.0.0.0
Jun 10 13:49:27 Input interface: 17
Jun 10 13:49:27 Output interface: 0
Jun 10 13:49:27 Pkts in flow: 6
Jun 10 13:49:27 Bytes in flow: 420
Jun 10 13:49:27 Start time of flow: 336827516
Jun 10 13:49:27 End time of flow: 336877526
Jun 10 13:49:27 Src port: 1158
Jun 10 13:49:27 Dst port: 646
Jun 10 13:49:27 TCP flags: 0x18
Jun 10 13:49:27 IP proto num: 6
Jun 10 13:49:27 TOS: 0xc0
Jun 10 13:49:27 Src AS: 1
Jun 10 13:49:27 Dst AS: 1
Jun 10 13:49:27 Src netmask len: 32
Jun 10 13:49:27 Dst netmask len: 32



bla@bla# run show interfaces | match ifIndex | match 17
Logical interface so-3/0/1.0 (Index 71) (SNMP ifIndex 17)


Tuesday, June 10, 2003, 11:27:53 AM, you wrote:

> I'm trying to collect some stats using the flow exports feature of JunOS
> (5.5R2.3)
> but have come across a problem.

> The router is setting the 'next-hop' value in the flow packet to
> '0.0.0.0' for
> flows that are destined towards a nexthop at the other end of a
> point-to-point
> SONET link.

> A 'show route' seems to give some clues as to the culprit:

>> show route xxxx extensive

> inet.0: 122127 destinations, 212622 routes (122123 active, 3 holddown, 1
> hidden)
> xxxx/32 (1 entry, 1 announced)
> TSI:
> KRT in-kernel xxxx/32 -> {so-0/0/0.0}
> *OSPF Preference: 10
> Next hop: via so-0/0/0.0, selected
> State: <Active Int>
> Local AS: 8737
> Age: 6d 5:05:51 Metric: 4
> Area: 0.0.0.0
> Task: OSPF
> Announcement bits (3): 0-KRT 4-Resolve inet.0 5-RT
> AS path: I

> The next hop here only shows an interface rather than an IP address, so
> presumably
> this is why the flow packets have 0.0.0.0 set for the next-hop.

> Is there a way around this? My flow analysis software gets somewhat
> confused
> and not happy when given a zero-value next hop, and ideally i'd like to
> see
> either the remote ip address of the SONET link or the 'final' next-hop.

> Thanks.
> Ben

> _______________________________________________
> juniper-nsp mailing list juniper-nsp@puck.nether.net
> http://puck.nether.net/mailman/listinfo/juniper-nsp