The sampling is more random - the probability of an individual packet being sampled is 1/1000, but it's not exactly every 1000th packet, and every linecard has an independent sampling engine.
A caveat on sample rate - some Juniper hardware (e.g. T-Series FPC3, MX960 DPC) will silently round that up to nearest 65535 / int(x), so pick sampling rates like 8191, 4095 rather than 4000, 10000. You can miss flows of any size - as the size of the flow increases, the probability you will sample at least one packet from it increases, but there are no guarantees. Run-length appears to be unsupported on newer (e.g. MX3D MPC) hardware. Regards, Phil On Tue, Jul 23, 2013 at 7:16 PM, chris r. <chri...@gmx.net> wrote: > Hi guys, > > I'm using Juniper hardware to sample traffic and dump it to NetFlow > data. In my config, the sampling rate is 1000, run-length is 0. > > According to the docs [1], this means that 1 out of 1000 packets per > flow is sampled. Does this mean that *always* the first (1001st, 2001st, > 3001st, ...) packet of a flow is included (as the figure in the docs > suggests) or is the sampling more random? > > And if sampling is done more random: Can I miss flows due to packet > sampling, e.g., if flows have fewer than 1000 packets? > > Thanks a lot for your help, > Chris > > [1]: > > http://www.juniper.net/techpubs/software/junos/junos94/swconfig-policy/configuring-traffic-sampling.html#id-11354799 > _______________________________________________ > juniper-nsp mailing list juniper-nsp@puck.nether.net > https://puck.nether.net/mailman/listinfo/juniper-nsp > _______________________________________________ juniper-nsp mailing list juniper-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/juniper-nsp