I’ve been hanging onto the outline of this blog since August of 2010 so, it’s probably high time I organize the information and post it. The basis of the following was obtained from a customer exporting sampled J-Flow from a Juniper router. For those of you who don’t know what J-Flow is, it is basically NetFlow.  IPFIX is the emerging standard for NetFlow.   This blog is about MPLS tags.

A customer called in looking to report on MPLS tags. Juniper J-Flow MPLS sampling will export the following fields in their template:

  • MPLS Label #1
  • MPLS Label #2
  • MPLS Label #3
  • MPLS EXP Information
  • FEC IP Address

Cisco also supports NetFlow MPLS exports.  This customer wanted to report on the MPLS tags using NetFlow.  I was excited at the opportunity to create a new report and decided to look at templates they were exporting.  I found two.

Juniper J-FLow MPLS Tags

The first template 10021 told us that the flows were being sampled 1 in every 1000 packets. This template was being exported once every minute.

The second template 10022 contain the actual flows which are used by Scrutinizer for the majority of J-Flow reporting.

J-Flow Sampling Rate

I opened up the template with FlowView to view all of the fields and noticed 3 fields I hadn’t seen before:

  • mplsLabelStackSection
  • mplsLabelStackSection2
  • mplsLabelStackSection3
MPLS Label Format

We were able to provide the BGP / Autonomous System reports he was looking for based on MPLS filters. He then wanted some MPLS tag NetFlow reports which are still under consideration.  Here’s what I want to know; who else is looking for MPLS tag reports using NetFlow?  Contact me if you’re interested.

Mike Patterson author pic


Michael is one of the Co-founders and the former product manager for Scrutinizer. He enjoys many outdoor winter sports and often takes videos when he is snowmobiling, ice fishing or sledding with his kids. Cold weather and lots of snow make the best winters as far as he is concerned. Prior to starting Somix and Plixer, Mike worked in technical support at Cabletron Systems, acquired his Novell CNE and then moved to the training department for a few years. While in training he finished his Masters in Computer Information Systems from Southern New Hampshire University and then left technical training to pursue a new skill set in Professional Services. In 1998 he left the 'Tron' to start Somix which later became Plixer.


Big Data

Sankey Flow Graph

One of the greatest benefits of NetFlow collection for traffic analysis, is we’re provided with the ability to visualize the…

Leave a Reply