Configuring sFlow and IPFIX on Juniper MX routers helps network teams identify bandwidth consumers and investigate unusual traffic patterns. A successful deployment requires more than a collector address: hardware support, sampling direction and correct interpretation of exported data all matter.
This guide provides a practical workflow for ISP, data center and NOC teams. The commands are illustrative rather than a production-ready configuration. Review your Junos release, MPC model and existing sampling settings before applying changes.
What is the difference between sFlow and IPFIX?
sFlow exports packet samples and interface counters to a collector. IPFIX transports flow records described by templates. On Juniper MX, classic inline-jFlow can export flow records in IPFIX format. IPFIX does not imply full packet capture: the example below also relies on sampling.
For background, see our NetFlow, sFlow and port mirroring comparison. This article focuses on MX configuration and verification rather than repeating the protocol overview.
1. Check the MX model, MPC and Junos support
show version
show chassis hardware
show chassis fpc
show configuration protocols sflow | display set
show configuration forwarding-options sampling | display set
show configuration chassis | display set | match sampling-instanceThe same MX chassis can contain different generations of line cards. Juniper's technical discussion associates classic sFlow support with uKernel-based platforms, while newer AFT-based platforms use alternatives such as IMON. A chassis name such as MX240 or MX960 is therefore insufficient to determine support. Check the exact card and software release.
Distinguish IMON from classic IPFIX flow export
Packet-header sampling through IMON/IPFIX 315 is a different data model from the classic IPv4 inline-jFlow configuration shown here. The collector must decode the relevant record type. Accepting IPFIX does not automatically mean a collector supports every IPFIX information element.
2. Prepare collector connectivity and a sampling plan
The examples assume an existing router address of 192.0.2.1, a collector at 192.0.2.10, interface xe-1/0/0.0 and FPC slot 1. These are documentation addresses; replace them with your own values. The source address must be configured locally on the router, and the collector must be reachable through the intended routing path.
- sFlow collector listener: UDP 6343.
- IPFIX collector listener in this example: UDP 4739. If you use UDP 2055 instead, configure the same port at both ends.
- Initial sampling ratio: 1:1000. Test this against visibility requirements and capacity.
- The examples start with ingress sampling. If you monitor both directions or multiple observation points, account for duplicate measurements.
Restrict collector firewall rules to authorized exporters. If you collect the same traffic through sFlow and IPFIX, validate each data set separately before combining reports.
3. Configure sFlow on a supported Juniper MX platform
This ingress example applies only to platforms that support sFlow. The polling interval controls interface-counter collection frequency; the sample rate controls packet sampling.
configure
set protocols sflow source-ip 192.0.2.1
set protocols sflow polling-interval 30
set protocols sflow sample-rate ingress 1000
set protocols sflow collector 192.0.2.10 udp-port 6343
set protocols sflow interfaces xe-1/0/0.0
show | compare
commit check
commit confirmed 5After operational checks succeed, issue a normal commit to confirm the change permanently. If the device rejects a command or interface, check the error and release documentation rather than forcing an unsupported configuration.
Verify sFlow
run show sflow
run show sflow interface
run show sflow collectorCheck the enabled interface, collector port and actual sampling rate. If adaptive sampling takes effect, verify that the collector accounts for the reported rate. A smaller sampling denominator can increase export volume and processing load, so begin with a limited scope.
4. Configure IPv4 IPFIX with inline-jFlow
The configuration sequence is an IPFIX template, a sampling instance, an FPC association and interface sampling. Review existing instances before adding another: the one-sampling-instance-per-FPC restriction is important.
configure
set services flow-monitoring version-ipfix template FLOWTRION-V4 ipv4-template
set services flow-monitoring version-ipfix template FLOWTRION-V4 flow-active-timeout 60
set services flow-monitoring version-ipfix template FLOWTRION-V4 flow-inactive-timeout 15
set services flow-monitoring version-ipfix template FLOWTRION-V4 template-refresh-rate seconds 30
set services flow-monitoring version-ipfix template FLOWTRION-V4 option-refresh-rate seconds 30
set forwarding-options sampling instance FLOWTRION input rate 1000
set forwarding-options sampling instance FLOWTRION family inet output flow-server 192.0.2.10 port 4739
set forwarding-options sampling instance FLOWTRION family inet output flow-server 192.0.2.10 version-ipfix template FLOWTRION-V4
set forwarding-options sampling instance FLOWTRION family inet output inline-jflow source-address 192.0.2.1
set chassis fpc 1 sampling-instance FLOWTRION
set interfaces xe-1/0/0 unit 0 family inet sampling input
show | compare
commit check
commit confirmed 5This example covers IPv4. IPv6 requires an appropriate template and a separate family inet6 design. Check support and FPC scope for AE, IRB and interfaces on other cards. Do not automatically add resource changes such as flow-table sizing; confirm their hardware-specific impact first.
Verify IPFIX
run show services accounting status inline-jflow fpc-slot 1
run show services accounting flow inline-jflow fpc-slot 1
run show services accounting errors inline-jflow fpc-slot 1Confirm that the collector receives both template and data sets. Data records may remain undecodable until their template arrives. Check interface mappings and timestamps alongside the router's operational output. Once validation succeeds, confirm the pending commit before its rollback timer expires.
5. Troubleshoot missing collector data
No UDP packets arrive
Check the source address, route to the collector, intermediate firewalls and listener port. On a Linux collector, the following commands can help:
ss -lunp | grep -E ':(6343|4739)\b'
sudo tcpdump -ni any 'host 192.0.2.1 and udp and (port 6343 or port 4739)'Packets arrive but no charts appear
Review the exporter definition, IPFIX template decoding, observation domain identity and interface indexes. An open listener does not prove successful decoding. Limit access to packet captures because they contain network metadata.
Traffic values are unexpectedly high or low
Check that sampling compensation is not applied twice, ingress and egress records are not mixed, and the same traffic is not counted repeatedly across exporters. Compare interface counters and flow charts using the same time window and direction.
Move from collection to operational analysis with Flowtrion
First validate the exporter, interface, direction and reported traffic volume. Then examine source and destination addresses and ports to establish a baseline. Our article on the importance of network traffic analysis explains how these measurements support NOC operations.
For DDoS use cases, telemetry is an input to detection; exporting traffic data alone does not block an attack. See our NetFlow/sFlow DDoS detection and BGP mitigation guide for the response workflow. Observe thresholds against real traffic before enabling automated actions.
Frequently asked questions
Does every Juniper MX support sFlow?
No universal assumption is safe. Support depends on the platform, line card architecture and Junos release. Verify sFlow support or an appropriate alternative for the installed hardware.
Must IPFIX use UDP 2055?
No. This guide uses UDP 4739. Exporter and collector ports must match, and the network path must allow the traffic.
Is 1:1000 sampling suitable for every network?
No. Consider traffic volume, visibility into short flows and router/collector capacity together. The ratio here is a starting example.
Sources
- Juniper: Configuring Traffic Sampling on MX, M and T Series Routers
- Juniper: IPFIX Templates and Configuration Examples
- Juniper: Understand Inline Active Flow Monitoring
- Juniper Technical Community: From sFlow to IMON Flow Sampling on MX10K Platforms
- Juniper: sFlow Settings and Verification Commands (check platform scope)
Technical source review: 24 October 2026. Check the current release notes and hardware restrictions for your device before implementation.