Mailing List Archive: nsp: juniper

IPFIX - "no template found" in wireshark of Flow Collector

Index | Next | Previous | View Threaded

narain.arun at gmail

Mar 23, 2012, 11:25 AM

Post #1 of 4 (583 views)
Permalink

IPFIX - "no template found" in wireshark of Flow Collector

Hi NSP,

I configured IPFIX in juniper MX running 11.2 R3. I run wireshark in flow
collector where i m getting flows from the juniper router but all data are
showing "no template found"? What is the problem in this? I had a problem
on the same router where i was told to move to another PIC/port. I ve done
the same but now getting this error? What could be the cause of this? Is
the router not supporting the flow or not sending the flow in proper format?

thanks in advance
Arun
_______________________________________________
juniper-nsp mailing list juniper-nsp [at] puck
https://puck.nether.net/mailman/listinfo/juniper-nsp

timamaryin at mail

Mar 24, 2012, 1:44 AM

Post #2 of 4 (540 views)
Permalink

Re: IPFIX - "no template found" in wireshark of Flow Collector [In reply to]

Hi,

Try Analyze -> Decode as then cflow

On 23.03.2012 22:25, Arun Kumar wrote:
> Hi NSP,
>
> I configured IPFIX in juniper MX running 11.2 R3. I run wireshark in flow
> collector where i m getting flows from the juniper router but all data are
> showing "no template found"? What is the problem in this? I had a problem
> on the same router where i was told to move to another PIC/port. I ve done
> the same but now getting this error? What could be the cause of this? Is
> the router not supporting the flow or not sending the flow in proper format?
>
> thanks in advance
> Arun

_______________________________________________
juniper-nsp mailing list juniper-nsp [at] puck
https://puck.nether.net/mailman/listinfo/juniper-nsp

narain.arun at gmail

Mar 24, 2012, 3:03 AM

Post #3 of 4 (545 views)
Permalink

Re: IPFIX - "no template found" in wireshark of Flow Collector [In reply to]

Hi,

After I decoded the packet capture as cflow only, i m seeing that output
(no template found). Its there under Data section of Cisco NetFlow/IPFIX.

On Sat, Mar 24, 2012 at 2:14 PM, Tima Maryin <timamaryin [at] mail> wrote:

> Hi,
>
> Try Analyze -> Decode as then cflow
>
>
>
> On 23.03.2012 22:25, Arun Kumar wrote:
>
>> Hi NSP,
>>
>> I configured IPFIX in juniper MX running 11.2 R3. I run wireshark in flow
>> collector where i m getting flows from the juniper router but all data are
>> showing "no template found"? What is the problem in this? I had a problem
>> on the same router where i was told to move to another PIC/port. I ve done
>> the same but now getting this error? What could be the cause of this? Is
>> the router not supporting the flow or not sending the flow in proper
>> format?
>>
>> thanks in advance
>> Arun
>>
>
> ______________________________**_________________
> juniper-nsp mailing list juniper-nsp [at] puck
> https://puck.nether.net/**mailman/listinfo/juniper-nsp<https://puck.nether.net/mailman/listinfo/juniper-nsp>
>
_______________________________________________
juniper-nsp mailing list juniper-nsp [at] puck
https://puck.nether.net/mailman/listinfo/juniper-nsp

p.mayers at imperial

Mar 24, 2012, 5:11 AM

Post #4 of 4 (557 views)
Permalink

Re: IPFIX - "no template found" in wireshark of Flow Collector [In reply to]

On 03/23/2012 06:25 PM, Arun Kumar wrote:
> Hi NSP,
>
> I configured IPFIX in juniper MX running 11.2 R3. I run wireshark in flow
> collector where i m getting flows from the juniper router but all data are
> showing "no template found"? What is the problem in this? I had a problem

This is normal and expected.

IPFIX/Neflow9 exporters only send the templates periodically. They are
not sent with every packet.

You need to leave your capture running for long enough that it:

1. Sees a packet with IPFIX/NF9 templates
2. Sees data packets referencing those templates

On other (non-JunOS) platforms, I have been able to trigger a template
export by making and then un-making a config change to the netflow
export that will affect the templates e.g. remove then re-add src/dst AS
number.

Many/most platforms have configuration for the interval to re-send the
templates; I think it is:

edit set service flow-monitoring version-ipfix template X
set template-refresh-rate [packets N | seconds Y]
_______________________________________________
juniper-nsp mailing list juniper-nsp [at] puck
https://puck.nether.net/mailman/listinfo/juniper-nsp

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads