Juniper architecture and interface counters

From Juniper Clue

Juniper's architecture processes and removes link-layer headers on the media-specific PICs before the packet ever reaches the rest of the PFE. Before the Q-Chip based PICs, there was no way to do any analysis or accounting of these link-layer headers. This presents several challenges and changes in behavior which need to be taken into account.

The SNMP specification calls for the ifInOctets and ifOutOctets MIBs to include link-layer headers in their counters. Most platforms from other vendors do this, but Juniper can not. This may result in data mismatches and potential incorrect analysis when comparing Juniper counters with those from other vendors.

This restriction is also what prohibits Ethernet MAC accounting and filtering on pre Q-Chip PICs, and what caused Tcpdump expressions issues in earlier JunOS code.