I’ve been hanging onto the outline of this blog since August of 2010 so, it’s probably high time I organize the information and post it. The basis of the following was obtained from a customer exporting sampled J-Flow from a Juniper router. For those of you who don’t know what J-Flow is, it is basically NetFlow. IPFIX is the emerging standard for NetFlow. This blog is about MPLS tags.
A customer called in looking to report on MPLS tags. Juniper J-Flow MPLS sampling will export the following fields in their template:
- MPLS Label #1
- MPLS Label #2
- MPLS Label #3
- MPLS EXP Information
- FEC IP Address
Cisco also supports NetFlow MPLS exports. This customer wanted to report on the MPLS tags using NetFlow. I was excited at the opportunity to create a new report and decided to look at templates they were exporting. I found two.
The first template 10021 told us that the flows were being sampled 1 in every 1000 packets. This template was being exported once every minute.
The second template 10022 contain the actual flows which are used by Scrutinizer for the majority of J-Flow reporting.
I opened up the template with FlowView to view all of the fields and noticed 3 fields I hadn’t seen before:
- mplsLabelStackSection
- mplsLabelStackSection2
- mplsLabelStackSection3
We were able to provide the BGP / Autonomous System reports he was looking for based on MPLS filters. He then wanted some MPLS tag NetFlow reports which are still under consideration. Here’s what I want to know; who else is looking for MPLS tag reports using NetFlow? Contact me if you’re interested.
