Re: [j-nsp] IPFIX - "no template found" in wireshark of Flow Collector

[Tima Maryin]

Hi,

Try Analyze -> Decode as then cflow

On 23.03.2012 22:25, Arun Kumar wrote:
> Hi NSP,
>
> I configured IPFIX in juniper MX running 11.2 R3. I run wireshark in flow
> collector where i m getting flows from the juniper router but all data are
> showing "no template found"? What is the problem in this? I had a problem
> on the same router where i was told to move to another PIC/port. I ve done
> the same but now getting this error? What could be the cause of this? Is
> the router not supporting the flow or not sending the flow in proper format?
>
> thanks in advance
> Arun

_______________________________________________
juniper-nsp mailing list junip...@puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp

[Arun Kumar]

Hi,

After I decoded the packet capture as cflow only, i m seeing that output
(no template found). Its there under Data section of Cisco NetFlow/IPFIX.

On Sat, Mar 24, 2012 at 2:14 PM, Tima Maryin <timam...@mail.ru> wrote:

> Hi,
>
> Try Analyze -> Decode as then cflow
>
>
>
> On 23.03.2012 22:25, Arun Kumar wrote:
>
>> Hi NSP,
>>
>> I configured IPFIX in juniper MX running 11.2 R3. I run wireshark in flow
>> collector where i m getting flows from the juniper router but all data are
>> showing "no template found"? What is the problem in this? I had a problem
>> on the same router where i was told to move to another PIC/port. I ve done
>> the same but now getting this error? What could be the cause of this? Is
>> the router not supporting the flow or not sending the flow in proper
>> format?
>>
>> thanks in advance
>> Arun
>>
>

> ______________________________**_________________
> juniper-nsp mailing list junip...@puck.nether.net
> https://puck.nether.net/**mailman/listinfo/juniper-nsp<https://puck.nether.net/mailman/listinfo/juniper-nsp>

[Phil Mayers]

On 03/23/2012 06:25 PM, Arun Kumar wrote:
> Hi NSP,
>
> I configured IPFIX in juniper MX running 11.2 R3. I run wireshark in flow
> collector where i m getting flows from the juniper router but all data are
> showing "no template found"? What is the problem in this? I had a problem

This is normal and expected.

IPFIX/Neflow9 exporters only send the templates periodically. They are
not sent with every packet.

You need to leave your capture running for long enough that it:

1. Sees a packet with IPFIX/NF9 templates
2. Sees data packets referencing those templates

On other (non-JunOS) platforms, I have been able to trigger a template
export by making and then un-making a config change to the netflow
export that will affect the templates e.g. remove then re-add src/dst AS
number.

Many/most platforms have configuration for the interval to re-send the
templates; I think it is:

edit set service flow-monitoring version-ipfix template X
set template-refresh-rate [packets N | seconds Y]