Traffic Sampling

Traffic sampling is a critical feature for network monitoring, analysis, and troubleshooting. On Juniper devices, the sampling feature allows you to capture a portion of the traffic flowing through the router and export it to flow collectors for analysis. This enables network administrators to gain visibility into traffic patterns, detect anomalies, and plan network capacity without the overhead of capturing all traffic.

This guide covers how to configure traffic sampling on Juniper devices using jflow (Juniper's implementation of netflow/IPFIX).

Components of Traffic Sampling

Juniper's traffic sampling configuration consists of several key components:

  1. Groups Configuration: Defines reusable configuration blocks

  2. Chassis Configuration: Defines hardware-level sampling settings

  3. Services Configuration: Configures flow monitoring templates

  4. Forwarding Options: Configures sampling instances and export parameters

Groups Configuration

The groups configuration allows you to define a configuration template that can be applied to multiple interfaces:

groups {
    sampling {
        interfaces {
            <*> {                       # Wildcard to match any interface
                unit <*> {              # Wildcard to match any unit
                    family inet {       # IPv4 configuration
                        sampling {
                            input;      # Sample incoming IPv4 traffic
                        }
                    }
                    family inet6 {      # IPv6 configuration
                        sampling {
                            input;      # Sample incoming IPv6 traffic
                        }
                    }
                }
            }
        }
    }
}

Key points about this group configuration:

  • The <*> wildcards allow this configuration to be applied to any interface and unit

  • input indicates that only incoming traffic will be sampled

  • Both IPv4 and IPv6 traffic are configured for sampling

Chassis Configuration

The chassis configuration defines hardware-level settings for sampling:

Key points about the chassis configuration:

  • sampling-instance associates the FPC with a specific sampling instance

  • inline-services enables inline jflow processing

  • flow-table-size configures the size of flow tables for IPv4 and IPv6:

    • Values range from 0 (smallest) to 9 (largest)

    • Larger values consume more memory but allow tracking more flows

Services Configuration

The services section configures the flow monitoring templates:

Key points about the services configuration:

  • version9 specifies NetFlow version 9 format (industry standard)

  • flow-active-timeout defines when active flows are exported (in seconds)

  • flow-inactive-timeout defines when inactive flows are exported (in seconds)

  • template-refresh-rate controls how often the template is sent to the collector

  • option-refresh-rate controls how often option templates are sent

Forwarding Options Configuration

The forwarding-options section defines the sampling instance, rate, and export destinations:

Key points about the forwarding options configuration:

  • rate 2048 means 1 out of every 2048 packets will be sampled (sampling ratio of 1:2048)

  • max-packets-per-second limits the number of sampled packets to prevent overwhelming the system

  • flow-server specifies the IP address and port of the NetFlow collector

  • autonomous-system-type origin includes the origin AS in flow records (useful for BGP analysis)

  • source-address defines the source IP address to use when sending flow records

  • inline-jflow configures inline flow processing (more efficient than service PIC-based sampling)

Applying Sampling to Interfaces

To apply sampling to interfaces, you use the apply-groups command at the interface level:

This applies all the configuration in the "sampling" group to this specific interface unit.

Verification Commands

To verify that traffic sampling is working correctly, you can use these commands:

Best Practices

  1. Sampling Rate: Choose an appropriate sampling rate based on your traffic volume and monitoring needs

    • High-volume networks may need higher sampling rates (e.g., 1:8192)

    • Lower sampling rates provide more accuracy but increase processing load

  2. Resource Considerations: Monitor CPU and memory usage to ensure sampling doesn't impact performance

    • Adjust max-packets-per-second to limit resource consumption

  3. Flow Export: Configure multiple flow collectors for redundancy

  4. Template Refresh: Set appropriate template refresh rates

    • Too frequent refreshes add overhead

    • Too infrequent refreshes may cause the collector to miss templates

  5. Source Address: Use a stable, dedicated IP address for flow export

    • Ideally from a loopback interface

  6. Flow Table Size: Set appropriate flow table sizes based on your network's flow diversity

    • Larger networks with many unique flows need larger flow tables

  7. Interface Selection: Apply sampling only to interfaces where flow data is valuable

    • Avoid sampling on management or internal interfaces

Common Applications

  • Traffic Analysis: Understand traffic patterns and top talkers

  • Capacity Planning: Track traffic growth and plan network expansion

  • Security Monitoring: Detect DDoS attacks and unusual traffic patterns

  • Performance Troubleshooting: Identify sources of latency or packet loss

  • Billing and Accounting: Track usage for billing purposes

Properly configured traffic sampling provides valuable network visibility with minimal impact on router performance.

PreviousInterfaceNextRouting Instance

Last updated