- match interface (Flexible NetFlow)
- match ipv4
- match ipv4 destination
- match ipv4 fragmentation
- match ipv4 section
- match ipv4 source
- match ipv4 total-length
- match ipv4 ttl
- match ipv6
- match ipv6 destination
- match ipv6 extension map
- match ipv6 fragmentation
- match ipv6 hop-limit
- match ipv6 length
- match ipv6 section
- match ipv6 source
- match routing
- match routing is-multicast
- match routing multicast replication-factor
- match transport
- match transport icmp ipv4
- match transport icmp ipv6
- match transport tcp
- match transport udp
- mode (Flexible NetFlow)
- option (Flexible NetFlow)
- output-features
- record
- sampler
- show flow exporter
- show flow interface
- show flow monitor
- show flow monitor cache aggregate
- show flow monitor cache filter
- show flow monitor cache sort
- show flow record
- show platform flow
- show sampler
- source (Flexible NetFlow)
- statistics packet
- template data timeout
- transport (Flexible NetFlow)
- ttl (Flexible NetFlow)
match interface (Flexible NetFlow)
To configure the input and output interfaces as key fields for a Flexible NetFlow flow record, use the match interface command in Flexible NetFlow flow record configuration mode. To disable the use of the input and output interfaces as key fields for a Flexible NetFlow flow record, use the no form of this command.
match interface {input | output}
no match interface {input | output}
Cisco Catalyst 6500 Switches in Cisco IOS Release 12.2(50)SY
match interface {input [physical] | output} [snmp]
no match interface {input [physical] | output} [snmp]
Syntax Description
Command Default
The input and output interfaces are not configured as key fields.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures the input interface as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match interface input
The following example configures the output interface as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match interface output
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv4
To configure one or more of the IPv4 fields as a key field for a Flexible NetFlow flow record, use the match ipv4 command in Flexible NetFlow flow record configuration mode. To disable the use of one or more of the IPv4 fields as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv4 {dscp | header-length | id | option map | precedence | protocol | tos | version}
no match ipv4 {dscp | header-length | id | option map | precedence | protocol | tos | version}
Syntax Description
Command Default
The use of one or more of the IPv4 fields as a key field for a user-defined Flexible NetFlow flow record is not enabled by default.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Note 
Some of the keywords of the match ipv4 command are documented as separate commands. All of the keywords for the match ipv4 command that are documented separately start with match ipv4. For example, for information about configuring the IPv4 time-to-live (TTL) field as a key field for a Flexible NetFlow flow record, refer to the match ipv4 ttl command.
Examples
The following example configures the IPv4 DSCP field as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv4 dscp
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv4 destination
To configure the IPv4 destination address as a key field for a Flexible NetFlow flow record, use the match ipv4 destination command in Flexible NetFlow flow record configuration mode. To disable the IPv4 destination address as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv4 destination {address | {mask | prefix} [minimum-mask mask]}
no match ipv4 destination {address | {mask | prefix} [minimum-mask mask]}
Syntax Description
Command Default
The IPv4 destination address is not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures a 16-bit IPv4 destination address prefix as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv4 destination prefix minimum-mask 16
The following example specifies a 16-bit IPv4 destination address mask as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv4 destination mask minimum-mask 16
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv4 fragmentation
To configure the IPv4 fragmentation flags and the IPv4 fragmentation offset as key fields for a Flexible NetFlow flow record, use the match ipv4 fragmentation command in Flexible NetFlow flow record configuration mode. To disable the use of the IPv4 fragmentation flags and the IPv4 fragmentation offset as key fields for a Flexible NetFlow flow record, use the no form of this command.
match ipv4 fragmentation {flags | offset}
no match ipv4 fragmentation {flags | offset}
Syntax Description
flags |
Configures the IPv4 fragmentation flags as a key field. |
offset |
Configures the IPv4 fragmentation offset as a key field. |
Command Default
The IPv4 fragmentation flags and the IPv4 fragmentation offset are not configured as key fields.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
match ipv4 fragmentation flags
This field matches the "don't fragment" and "more fragments" flags.
Bit 0: reserved, must be zero
Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment
Bit 2: (MF) 0 = Last Fragment,1 = More Fragments
Bits 3-7: (DC) Don't Care, value is irrelevant
0 1 2 3 4 5 6 7
+---+---+---+---+---+---+---+---+
| | D | M | D | D | D | D | D |
| 0 | F | F | C | C | C | C | C |
+---+---+---+---+---+---+---+---+
For more information on IPv4 fragmentation flags, see RFC 791, Internet Protocol at the following URL: http://www.ietf.org/rfc/rfc791.txt.
Examples
The following example configures the IPv4 fragmentation flags as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv4 fragmentation flags
The following example configures the IPv4 offset flag as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv4 fragmentation offset
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv4 section
To configure a section of an IPv4 packet as a key field for a Flexible NetFlow flow record, use the match ipv4 section command in Flexible NetFlow flow record configuration mode. To disable the use of a section of an IPv4 packet as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv4 section {header size header-size | payload size payload-size}
no match ipv4 section {header size header-size | payload size payload-size}
Syntax Description
Command Default
A section of an IPv4 packet is not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
match ipv4 section header
This command uses the section of the IPv4 header indicated by the header size header-size keyword and argument as a key field. Only the configured size in bytes will be matched, and part of the payload will also be matched if the configured size is larger than the size of the header.
Note This command can result in large records that use a large amount of router memory and export bandwidth.
match ipv4 section payload
This command uses the section of the IPv4 payload indicated by the payload size payload-size keyword and argument as a key field.
Note This command can result in large records that use a large amount of router memory and export bandwidth.
Examples
The following example configures the first four bytes (the IPv4 version field) as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv4 section header size 4
The following example configures the first 16 bytes from the payload of the IPv4 packets in the flow as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv4 section payload size 16
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv4 source
To configure the IPv4 source address as a key field for a Flexible NetFlow flow record, use the match ipv4 source command in Flexible NetFlow flow record configuration mode. To disable the use of the IPv4 source address as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv4 source {address | {mask | prefix} [minimum-mask mask]}
no match ipv4 source {address | {mask | prefix} [minimum-mask mask]}
Syntax Description
Command Default
The IPv4 source address is not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
match ipv4 source prefix minimum-mask
The source address prefix field is the network part of the source address. The optional minimum mask allows a more information to be gathered about large networks.
match ipv4 source mask minimum-mask
The source address mask is the number of bits that make up the network part of the source address. The optional minimum mask allows a minimum value to be configured. This command is useful when there is a minimum mask configured for the source prefix field and the mask is to be used with the prefix. In this case, the values configured for the minimum mask should be the same for the prefix and mask fields.
Alternatively, if the collector knows the minimum mask configuration of the prefix field, the mask field can be configured without a minimum mask so that the true mask and prefix can be calculated.
Examples
The following example configures a 16-bit IPv4 source address prefix as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv4 source prefix minimum-mask 16
The following example specifies a 16-bit IPv4 source address mask as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv4 source mask minimum-mask 16
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv4 total-length
To configure the IPv4 total-length field as a key field for a Flexible NetFlow flow record, use the match ipv4 total-length command in Flexible NetFlow flow record configuration mode. To disable the use of the IPv4 total-length field as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv4 total-length
no match ipv4 total-length
Syntax Description
This command has no arguments or keywords.
Command Default
The IPv4 total-length field is not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures the total-length value as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv4 total-length
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv4 ttl
To configure the IPv4 time-to-live (TTL) field as a key field for a Flexible NetFlow flow record, use the match ipv4 ttl command in Flexible NetFlow flow record configuration mode. To disable the use of the IPv4 TTL field as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv4 ttl
no match ipv4 ttl
Syntax Description
This command has no arguments or keywords.
Command Default
The IPv4 time-to-live (TTL) field is not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures IPv4 TTL as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv4 ttl
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv6
To configure one or more of the IPv6 fields as a key field for a Flexible NetFlow flow record, use the match ipv6 command in Flexible NetFlow flow record configuration mode. To disable the use of one or more of the IPv6 fields as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv6 {dscp | flow-label | next-header | payload-length | precedence | protocol | traffic-class | version}
no match ipv6 {dscp | flow-label | next-header | payload-length | precedence | protocol | traffic-class | version}
Syntax Description
Command Default
The IPv6 fields are not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Note Some of the keywords of the match ipv6 command are documented as separate commands. All of the keywords for the match ipv6 command that are documented separately start with match ipv6. For example, for information about configuring the IPv6 hop limit as a key field for a Flexible NetFlow flow record, refer to the match ipv6 hop-limit command.
Examples
The following example configures the IPv6 DSCP field as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 dscp
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv6 destination
To configure the IPv6 destination address as a key field for a Flexible NetFlow flow record, use the match ipv6 destination command in Flexible NetFlow flow record configuration mode. To disable the IPv6 destination address as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv6 destination {address | {mask | prefix} [minimum-mask mask]}
no match ipv6 destination {address | {mask | prefix} [minimum-mask mask]}
Syntax Description
Command Default
The IPv6 destination address is not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures a 16-bit IPv6 destination address prefix as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 destination prefix minimum-mask 16
The following example specifies a 16-bit IPv6 destination address mask as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 destination mask minimum-mask 16
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv6 extension map
To configure the bitmap of the IPv6 extension header map as a key field for a Flexible NetFlow flow record, use the match ipv6 extension map command in Flexible NetFlow flow record configuration mode. To disable the use of the IPv6 bitmap of the IPv6 extension header map as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv6 extension map
no match ipv6 extension map
Syntax Description
This command has no arguments or keywords.
Command Default
The use of the bitmap of the IPv6 extension header map as a key field for a user-defined Flexible NetFlow flow record is not enabled by default.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Bitmap of the IPv6 Extension Header Map
The bitmap of IPv6 extension header map is made up of 32 bits.
0 1 2 3 4 5 6 7
+-----+-----+-----+-----+-----+-----+-----+-----+
| Res | FRA1| RH | FRA0| UNK | Res | HOP | DST |
+-----+-----+-----+-----+-----+-----+-----+-----+
8 9 10 11 12 13 14 15
+-----+-----+-----+-----+-----+-----+-----+-----+
| PAY | AH | ESP | Reserved |
+-----+-----+-----+-----+-----+-----+-----+-----+
16 17 18 19 20 21 22 23
+-----+-----+-----+-----+-----+-----+-----+-----+
| Reserved |
+-----+-----+-----+-----+-----+-----+-----+-----+
24 25 26 27 28 29 30 31
+-----+-----+-----+-----+-----+-----+-----+-----+
| Reserved |
+-----+-----+-----+-----+-----+-----+-----+-----+
0 Res Reserved
1 FRA1 Fragmentation header - not first fragment
2 RH Routing header
3 FRA0 Fragment header - first fragment
4 UNK Unknown Layer 4 header
(compressed, encrypted, not supported)
5 Res Reserved
6 HOP Hop-by-hop option header
7 DST Destination option header
8 PAY Payload compression header
9 AH Authentication Header
10 ESP Encrypted security payload
11 to 31 Reserved
For more information on IPv6 headers, refer to RFC 2460 Internet Protocol, Version 6 (IPv6) at the following URL: http://www.ietf.org/rfc/rfc2460.txt.
Examples
The following example configures the IPv6 bitmap of the IPv6 extension header map of the packets in the flow as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 extension map
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv6 fragmentation
To configure one or more of the IPv6 fragmentation fields as a key field for a Flexible NetFlow flow record, use the match ipv6 fragmentation command in Flexible NetFlow flow record configuration mode. To disable the use of the IPv6 fragmentation field as a key field for a Flexible NetFlow flow record, use the no form of this command.
match IPv6 fragmentation {flags | id | offset}
no match IPv6 fragmentation {flags | id | offset}
Syntax Description
flags |
Configures the IPv6 fragmentation flags as a key field. |
id |
Configures the IPv6 fragmentation ID as a key field. |
offset |
Configures the IPv6 fragmentation offset value as a key field. |
Command Default
The IPv6 fragmentation field is not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures the IPv6 fragmentation flags a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 fragmentation flags
The following example configures the IPv6 offset value a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 fragmentation offset
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv6 hop-limit
To configure the IPv6 hop limit as a key field for a Flexible NetFlow flow record, use the match ipv6 hop-limit command in Flexible NetFlow flow record configuration mode. To disable the use of a section of an IPv6 packet as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv6 hop-limit
no match ipv6 hop-limit
Syntax Description
This command has no arguments or keywords.
Command Default
The use of the IPv6 hop limit as a key field for a user-defined Flexible NetFlow flow record is not enabled by default.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures the hop limit of the packets in the flow as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 hop-limit
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv6 length
To configure one or more of the IPv6 length fields as a key field for a Flexible NetFlow flow record, use the match ipv6 length command in Flexible NetFlow flow record configuration mode. To disable the use of the IPv6 length field as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv6 length {header | payload | total}
no match ipv6 length {header | payload | total}
Syntax Description
Command Default
The IPv6 length field is not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures the length of the IPv6 header in bytes, not including any extension headers, as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 length header
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv6 section
To configure a section of an IPv6 packet as a key field for a Flexible NetFlow flow record, use the match ipv6 section command in Flexible NetFlow flow record configuration mode. To disable the use of a section of an IPv6 packet as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv6 section {header size header-size | payload size payload-size}
no match ipv6 section {header size header-size | payload size payload-size}
Syntax Description
Command Default
A section of an IPv6 packet is not configured as a key.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
match ipv6 section header
This command uses the section of the IPv6 header indicated by the header size header-size keyword and argument as a key field. Only the configured size in bytes will be matched, and part of the payload will also be matched if the configured size is larger than the size of the header.
Note This command can result in large records that use a large amount of router memory and export bandwidth.
match ipv6section payload
This command uses the section of the IPv6 payload indicated by the payload size payload-size keyword and argument as a key field.
Note This command can result in large records that use a large amount of router memory and export bandwidth.
Examples
The following example configures the first four bytes (the IP version field) from the IPv6 header of the packets in the flows as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 section header size 4
The following example configures the first 16 bytes from the payload of the IPv6 packets in the flows as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 section payload size 16
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match ipv6 source
To configure the IPv6 source address as a key field for a Flexible NetFlow flow record, use the match ipv6 source command in Flexible NetFlow flow record configuration mode. To disable the use of the IPv6 source address as a key field for a Flexible NetFlow flow record, use the no form of this command.
match ipv6 source {address | {mask | prefix} [minimum-mask mask]}
no match ipv6 source {address | {mask | prefix} [minimum-mask mask]}
Syntax Description
Command Default
The IPv6 source address is not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures a 16-bit IPv6 source address prefix as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 source prefix minimum-mask 16
The following example specifies a 16-bit IPv6 source address mask as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match ipv6 source mask minimum-mask 16
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match routing
To configure one or more of the routing fields as a key field for a Flexible NetFlow flow record, use the match routing command in Flexible NetFlow flow record configuration mode. To disable the use of one or more of the routing fields as a key field for a Flexible NetFlow flow record, use the no form of this command.
match routing {{destination | source} {as [[4-octet] peer] [4-octet] | traffic-index} | forwarding-status | next-hop address {ipv4 | ipv6} [bgp] | vrf input}
no match routing {{destination | source} {as [[4-octet] peer] [4-octet] | traffic-index} | forwarding-status | next-hop address {ipv4 | ipv6} [bgp] | vrf input}
Command Default
The use of one or more of the routing fields as a key field for a user-defined Flexible NetFlow flow record is disabled.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
match routing source as [peer]
This command matches the 16-bit autonomous system number based on a lookup of the router's routing table using the source IP address. The optional peer keyword provides the expected next network, as opposed to the originating network.
match routing source as 4-octet [ 4-octet peer]
This command matches the 32-bit autonomous system number based on a lookup of the router's routing table using the source IP address. The optional peer keyword provides the expected next network, as opposed to the originating network.
match routing destination as [peer]
This command matches the 16-bit autonomous system number based on a lookup of the router's routing table using the destination IP address. The peer keyword will provide the expected next network as opposed to the destination network.
match routing destination as 4-octet [ 4-octet peer]
This command matches the 32-bit autonomous system number based on a lookup of the router's routing table using the destination IP address. The peer keyword will provide the expected next network as opposed to the destination network.
match routing destination traffic-index
This command matches the traffic-index field based on the destination autonomous system for this flow. The traffic-index field is a value propagated through BGP.
This command is not supported for IPv6.
match routing source traffic-index
This command matches the traffic-index field based on the source autonomous system for this flow. The traffic-index field is a value propagated through BGP.
This command is not supported for IPv6.
match routing forwarding-status
This command matches a field to indicate if the packets were successfully forwarded. The field is in two parts and may be up to 4 bytes in length. For the releases specified in the Command History table, only the status field is used:
+-+-+-+-+-+-+-+-+
| S | Reason |
| t | codes |
| a | or |
| t | flags |
| u | |
| s | |
+-+-+-+-+-+-+-+-+
0 1 2 3 4 5 6 7
Status:
00b=Unknown, 01b = Forwarded, 10b = Dropped, 11b = Consumed
match routing vrf input
This command matches the VRF ID from incoming packets on a router. In the case where VRFs are associated with an interface via methods such as VRF Selection Using Policy Based Routing/Source IP Address, a VRF ID of 0 will be recorded. If a packet arrives on an interface that does not belong to a VRF, a VRF ID of 0 is recorded.
Examples
The following example configures the source autonomous system as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match routing source as
The following example configures the destination autonomous system as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match routing destination as
The following example configures the BGP source traffic index as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match routing source traffic-index
The following example configures the forwarding status as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match routing forwarding-status
The following example configures the VRF ID for incoming packets as a key field for a Flexible NetFlow flow record:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match routing vrf input
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
match routing is-multicast
To configure the use of the is-multicast field (indicating that the IPv4 traffic is multicast traffic) as a key field for a Flexible NetFlow flow record, use the match routing is-multicast command in Flexible NetFlow flow record configuration mode. To disable the use of the is-multicast field as a key field for a Flexible NetFlow flow record, use the no form of this command.
match routing is-multicast
no match routing is-multicast
Syntax Description
This command has no arguments or keywords
Command Default
The is-multicast field is not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Examples
The following example configures the is-multicast field as a key field for a Flexible NetFlow flow record:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match routing is-multicast
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match routing multicast replication-factor
To configure the multicast replication factor value for IPv4 traffic as a key field for a Flexible NetFlow flow record, use the match multicast replication-factor command in Flexible NetFlow flow record configuration mode. To disable the use of the multicast replication factor value as a key field for a Flexible NetFlow flow record, use the no form of this command.
match routing multicast replication-factor
no match routing multicast replication-factor
Syntax Description
This command has no arguments or keywords.
Command Default
The multicast replication factor value is not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
When the replication-factor field is used in a flow record, it will only have a non-zero value in the cache for ingress multicast traffic that is forwarded by the router. If the flow record is used with a flow monitor in output (egress) mode or to monitor unicast traffic or both, the cache data for the replication factor field is set to 0.
Examples
The following example configures the multicast replication factor value as a key field for a Flexible NetFlow flow record:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match routing multicast replication-factor
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match transport
To configure one or more of the transport fields as a key field for a Flexible NetFlow flow record, use the match transport command in Flexible NetFlow flow record configuration mode. To disable the use of one or more of the transport fields as a key field for a Flexible NetFlow flow record, use the no form of this command.
match transport {destination-port | igmp type | source-port}
no match transport {destination-port | igmp type | source-port}
Syntax Description
Command Default
The transport fields are not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures the destination port as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport destination-port
The following example configures the source port as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport source-port
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match transport icmp ipv4
To configure the ICMP IPv4 type field and the code field as key fields for a Flexible NetFlow flow record, use the match transport icmp ipv4 command in Flexible NetFlow flow record configuration mode. To disable the use of the ICMP IPv4 type field and code field as key fields for a Flexible NetFlow flow record, use the no form of this command.
match transport icmp ipv4 {code | type}
no match transport icmp ipv4 {code | type}
Syntax Description
code |
Configures the IPv4 ICMP code as a key field. |
type |
Configures the IPv4 ICMP type as a key field. |
Command Default
The ICMP IPv4 type field and the code field are not configured as key fields.
Command Modes
Flexible NetFlow flow record configuration
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures the IPv4 ICMP code field as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport icmp ipv4 code
The following example configures the IPv4 ICMP type field as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport icmp ipv4 type
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match transport icmp ipv6
To configure the internet control message protocol ICMP IPv6 type field and the code field as key fields for a Flexible NetFlow flow record, use the match transport icmp ipv6 command in Flexible NetFlow flow record configuration mode. To disable the use of the ICMP IPv6 type field and code field as key fields for a Flexible NetFlow flow record, use the no form of this command.
match transport icmp ipv6 {code | type}
no match transport icmp ipv6 {code | type}
Syntax Description
code |
Configures the ICMP code as a key field. |
type |
Configures the ICMP type as a key field. |
Command Default
The ICMP IPv6 type field and the code field are not configured as key fields.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A Flow Record requires at least one key field before it can be used in a Flow Monitor. The Key fields differentiate Flows, with each flow having a unique set of values for the key fields. The Key fields are defined using the match command.
Examples
The following example configures the IPv6 ICMP code field as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport icmp ipv6 code
The following example configures the IPv6 ICMP type field as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport icmp ipv6 type
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match transport tcp
To configure one or more of the TCP fields as a key field for a Flexible NetFlow flow record, use the match transport tcp command in Flexible NetFlow flow record configuration mode. To disable the use of a TCP field as a key field for a Flexible NetFlow flow record, use the no form of this command.
see collect
match transport tcp {acknowledgement-number | destination-port | flags {[ack] | [cwr] | [ece] | [fin] | [psh] | [rst] | [syn] | [urg]} | header-length | sequence-number | source-port | urgent-pointer | window-size}
no match transport tcp {acknowledgement-number | destination-port | flags {ack] | [cwr] | [ece] | [fin] | [psh] | [rst] | [syn] | [urg]} | header-length | sequence-number | source-port | urgent-pointer | window-size}
Syntax Description
Command Default
The use of one or more of the TCP fields as a key field for a user-defined Flexible NetFlow flow record is not enabled by default.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures the TCP acknowledgement flag as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport tcp flags ack
The following example configures the TCP finish flag as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport tcp flags fin
The following example configures the TCP reset flag as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport tcp flags rst
The following example configures the transport destination port as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport tcp destination-port
The following example configures the transport source port as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport tcp source-port
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
match transport udp
To configure one or more of the user datagram protocol UDP fields as a key field for a Flexible NetFlow flow record, use the match transport udp command in Flexible NetFlow flow record configuration mode. To disable the use of a UDP field as a key field for a Flexible NetFlow flow record, use the no form of this command.
match transport udp {destination-port | message-length | source-port}
no match transport udp {destination-port | message-length | source-port}
Syntax Description
destination-port |
Configures the UDP destination port as a key field. |
message-length |
Configures the UDP message length as a key field. |
source-port |
Configures the UDP source port as a key field. |
Command Default
The UDP fields are not configured as a key field.
Command Modes
Flexible NetFlow flow record configuration (config-flow-record)
Command History
Usage Guidelines
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
Examples
The following example configures the UDP destination port as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport udp destination-port
The following example configures the UDP message length as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport udp message-length
The following example configures the UDP source port as a key field:
Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# match transport udp source-port
Related Commands
|
|
|
|---|---|
flow record |
Creates a flow record. |
mode (Flexible NetFlow)
To specify the type of sampling and the packet interval for a Flexible NetFlow sampler, use the mode command in Flexible NetFlow sampler configuration mode. To unconfigure the type of sampling and the packet interval for a Flexible NetFlow sampler, use the no form of this command.
mode {deterministic | random} 1 out-of window-size
no mode
Syntax Description
Command Default
The mode and the packet interval for a sampler are not configured.
Command Modes
Flexible NetFlow sampler configuration (config-sampler)
Command History
Usage Guidelines
Deterministic Mode
In deterministic mode, packets are chosen periodically based on the configured interval. This mode has less overhead than random mode and can be useful when sampling traffic that is random in nature. For more information about deterministic sampling, refer to the "Using Cisco IOS Flexible NetFlow Flow Sampling to Reduce the CPU Overhead of Analyzing Traffic" module in the Cisco IOS Flexible NetFlow Configuration Guide at the following URL: http://www.cisco.com/en/US/docs/ios/fnetflow/configuration/guide/use_fnflow_redce_cpu.html.
Random Mode
In random mode, packets are chosen in a manner that should eliminate any bias from traffic patterns and counter any attempt by users to avoid monitoring. For more information about random sampling, refer to the "Using Cisco IOS Flexible NetFlow Flow Sampling to Reduce the CPU Overhead of Analyzing Traffic" module in the Cisco IOS Flexible NetFlow Configuration Guide at the following URL: http://www.cisco.com/en/US/docs/ios/fnetflow/configuration/guide/use_fnflow_redce_cpu.html.
Examples
The following example enables deterministic sampling with a window size of 1000:
Router(config)# sampler SAMPLER-1
Router(config-sampler)# mode deterministic 1 out-of 1000
The following example enables random sampling with a window size of 1000:
Router(config)# sampler SAMPLER-1
Router(config-sampler)# mode random 1 out-of 1000
Related Commands
|
|
|
|---|---|
clear sampler |
Clears the sampler statistics. |
debug sampler |
Enables debugging output for samplers. |
show sampler |
Displays sampler status and statistics. |
option (Flexible NetFlow)
To configure options data parameters for a Flexible NetFlow flow exporter, use the option command in Flexible NetFlow flow exporter configuration mode. To remove options for a Flexible NetFlow flow exporter, use the no form of this command.
option {application-table | exporter-stats | interface-table | sampler-table | vrf-table} [timeout seconds]
no option {application-table | exporter-stats | interface-table | sampler-table | vrf-table}
Syntax Description
Command Default
The options data parameters are not configured.
Command Modes
Flexible NetFlow flow exporter configuration (config-flow-exporter)
Command History
Usage Guidelines
option application-table
This command causes the periodic sending of an options table, which will allow the collector to map the Network Based Application Recognition (NBAR) application IDs provided in the flow records to application names. The optional timeout can alter the frequency at which the reports are sent.
option exporter-stats
This command causes the periodic sending of the exporter statistics, including the number of records, bytes, and packets sent. This command allows your collector to estimate packet loss for the export records it is receiving. The optional timeout alters the frequency at which the reports are sent.
option interface-table
This command causes the periodic sending of an options table, which will allow the collector to map the interface SNMP indexes provided in the flow records to interface names. The optional timeout can alter the frequency at which the reports are sent.
option sampler-table
This command causes the periodic sending of an options table, which details the configuration of each sampler and allows the collector to map the sampler ID provided in any flow record to a configuration that it can use to scale up the flow statistics. The optional timeout can alter the frequency at which the reports are sent.
option vrf-table
This command causes the periodic sending of an options table, which will allow the collector to map the VRF IDs provided in the flow records to VRF names. The optional timeout can alter the frequency at which the reports are sent.
Examples
The following example causes the periodic sending of the exporter statistics, including the number of records, bytes, and packets sent:
Router(config)# flow exporter FLOW-EXPORTER-1
Router(config-flow-exporter)# option exporter-stats
The following example causes the periodic sending of an options table, which allows the collector to map the interface SNMP indexes provided in the flow records to interface names:
Router(config)# flow exporter FLOW-EXPORTER-1
Router(config-flow-exporter)# option interface-table
The following example causes the periodic sending of an options table, which details the configuration of each sampler and allows the collector to map the sampler ID provided in any flow record to a configuration that it can use to scale up the flow statistics:
Router(config)# flow exporter FLOW-EXPORTER-1
Router(config-flow-exporter)# option sampler-table
The following example causes the periodic sending of an options table, which allows the collector to map the NBAR application IDs provided in the flow records to application names:
Router(config)# flow exporter FLOW-EXPORTER-1
Router(config-flow-exporter)# option application-table
The following example causes the periodic sending of an options table, which allows the collector to map the VRF IDs provided in the flow records to VRF names:
Router(config)# flow exporter FLOW-EXPORTER-1
Router(config-flow-exporter)# option vrf-table
Related Commands
|
|
|
|---|---|
flow exporter |
Creates a flow exporter. |
output-features
To enable sending Flexible NetFlow export packets using quality of service (QoS) or encryption, use the output-features command in Flexible NetFlow flow exporter configuration mode. To disable sending export packets using QoS or encryption, use the no form of this command.
output-features
no output-features
Syntax Description
This command has no arguments or keywords.
Command Default
If QoS or encryption is configured on the router, neither QoS or encryption is run on Flexible NetFlow export packets.
Command Modes
Flexible NetFlow flow exporter configuration (config-flow-exporter)
Command History
|
|
|
|---|---|
12.4(20)T |
This command was introduced. |
Usage Guidelines
If the router has the output feature quality of service (QoS) or encryption configured, the output-features command causes the output features to be run on Flexible NetFlow export packets.
Examples
The following example configures the use of QoS or encryption on Flexible NetFlow export packets:
Router(config)# flow exporter FLOW-EXPORTER-1
Router(config-flow-exporter)# output-features
Related Commands
|
|
|
|---|---|
flow exporter |
Creates a flow exporter. |
record
To configure a flow record for a Flexible NetFlow flow monitor, use the record command in Flexible NetFlow flow monitor configuration mode. To remove a flow record for a Flexible NetFlow flow monitor, use the no form of this command.
record {record-name | netflow-original | netflow {ipv4 | ipv6} record [peer]}
no record
Cisco Catalyst 6500 Switches in Cisco IOS Release 12.2(50)SY
record {record-name | platform-original {ipv4 | ipv6} record }
no record
Syntax Description
record-name |
Name of a user-defined flow record that was previously configured. |
netflow-original |
Configures the flow monitor to use the Flexible NetFlow implementation of original NetFlow with origin autonomous systems. |
netflow ipv4 |
Configures the flow monitor to use one of the predefined IPv4 records. |
netflow ipv6 |
Configures the flow monitor to use one of the predefined IPv6 records. This keyword is not supported on the Cisco ASR 1000 Series Aggregation Services router. |
record |
Name of the predefined record. See Table 9 for a listing of the available records and their definitions. |
peer |
(Optional) Configures the flow monitor to use one of the predefined records with peer autonomous systems. The peer keyword is not supported for every type of Flexible NetFlow predefined record. See Table 9. |
platform-original ipv4 |
Configures the flow monitor to use one of the predefined IPv4 records. |
platform-original ipv6 |
Configures the flow monitor to use one of the predefined IPv6 records. |
Command Default
A flow record is not configured.
Command Modes
Flexible NetFlow flow monitor configuration (config-flow-monitor)
Command History
Usage Guidelines
Each flow monitor requires a record to define the contents and layout of its cache entries. The flow monitor can use one of the wide range of predefined record formats, or advanced users may create their own record formats.
Note You must use the no ip flow monitor command to remove a flow monitor from all of the interfaces to which you have applied it before you can modify the parameters for the record command for the flow monitor.
Table 9 describes the keywords and descriptions for the record argument.
Examples
The following example configures the flow monitor to use the NetFlow original record:
Router(config)# flow monitor FLOW-MONITOR-1
Router(config-flow-monitor)# record netflow-original
The following example configures the flow monitor to use a user-defined record named collect-ipv4-data:
Router(config)# flow monitor FLOW-MONITOR-1
Router(config-flow-monitor)# record collect-ipv4-data
The following example configures the flow monitor to use the Flexible NetFlow IPv4 destination prefix record:
Router(config)# flow monitor FLOW-MONITOR-1
Router(config-flow-monitor)# record netflow ipv4 destination-prefix
The following example configures the flow monitor to use a the Flexible NetFlow IPv6 destination prefix record:
Router(config)# flow monitor FLOW-MONITOR-1
Router(config-flow-monitor)# record netflow ipv6 destination-prefix
Related Commands
|
|
|
|---|---|
flow monitor |
Creates a flow monitor. |
sampler
To create a Flexible NetFlow flow sampler, or to modify an existing Flexible NetFlow flow sampler, and to enter Flexible NetFlow sampler configuration mode, use the sampler command in global configuration mode. To remove a sampler, use the no form of this command.
sampler sampler-name
no sampler sampler-name
Syntax Description
sampler-name |
Name of the flow sampler that is being created or modified. |
Command Default
Samplers are not configured.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Flow samplers are used to reduce the load placed by Flexible NetFlow on the networking device to monitor traffic by limiting the number of packets that are analyzed. You configure a rate of sampling that is 1 out of a range of 2 to 32,768 packets. For example, a rate of 1 out of 2 results in analysis of 50 percent of the packets sampled. Flow samplers are applied to interfaces in conjunction with a flow monitor to implement sampled Flexible NetFlow.
To enable flow sampling, you configure the record that you want to use for traffic analysis and assign it to a flow monitor. When you apply a flow monitor with a sampler to an interface, the sampled packets are analyzed at the rate specified by the sampler and compared with the flow record associated with the flow monitor. If the analyzed packets meet the criteria specified by the flow record, they are added to the flow monitor cache.
Examples
The following example creates a flow sampler name SAMPLER-1:
Router(config)# sampler SAMPLER-1
Router(config-sampler)#
Related Commands
show flow exporter
To display Flexible NetFlow flow exporter status and statistics, use the show flow exporter command in privileged EXEC mode.
show flow exporter [export-ids {netflow-v5 | netflow-v9} | [name] exporter-name [statistics | templates] [option application {engines | table}]]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Examples
The following example displays the status and statistics for all of the flow exporters configured on a router:
Router# show flow exporter
Flow Exporter FLOW-MONITOR-1:
Description: Exports to the datacenter
Export protocol: NetFlow Version 9
Transport Configuration:
Destination IP address: 172.16.10.2
Source IP address: 172.16.6.2
Source Interface: Ethernet0/0
Transport Protocol: UDP
Destination Port: 650
Source Port: 55864
DSCP: 0x3F
TTL: 15
Output Features: Used
Options Configuration:
exporter-stats (timeout 120 seconds)
interface-table (timeout 120 seconds)
sampler-table (timeout 120 seconds)
Table 10 describes the significant fields shown in the display.
The following example displays the NetFlow Version 9 export IDs for all of the flow exporters configured on a router. This output will vary according to the flow record configured:
Router# show flow exporter export-ids netflow-v9
Export IDs used by fields in NetFlow-common export format:
ip version : 60
ip tos : 194
ip dscp : 195
ip precedence : 196
ip protocol : 4
ip ttl : 192
ip ttl minimum : 52
ip ttl maximum : 53
ip length header : 189
ip length payload : 204
ip section header : 313
ip section payload : 314
routing source as : 16
routing destination as : 17
routing source as peer : 129
routing destination as peer : 128
routing source traffic-index : 92
routing destination traffic-index : 93
routing forwarding-status : 89
routing is-multicast : 206
routing next-hop address ipv4 : 15
routing next-hop address ipv4 bgp : 18
routing next-hop address ipv6 bgp : 63
ipv4 header-length : 207
ipv4 tos : 5
ipv4 total-length : 190
ipv4 total-length minimum : 25
ipv4 total-length maximum : 26
ipv4 id : 54
ipv4 fragmentation flags : 197
ipv4 fragmentation offset : 88
ipv4 source address : 8
ipv4 source prefix : 44
ipv4 source mask : 9
ipv4 destination address : 12
ipv4 destination prefix : 45
ipv4 destination mask : 13
ipv4 options : 208
transport source-port : 7
transport destination-port : 11
transport icmp-ipv4 type : 176
transport icmp-ipv4 code : 177
transport igmp type : 33
transport tcp source-port : 182
transport tcp destination-port : 183
transport tcp sequence-number : 184
transport tcp acknowledgement-number : 185
transport tcp header-length : 188
transport tcp window-size : 186
transport tcp urgent-pointer : 187
transport tcp flags : 6
transport udp source-port : 180
transport udp destination-port : 181
transport udp message-length : 205
interface input snmp : 10
interface output snmp : 14
interface name : 82
interface description : 83
flow direction : 61
flow exporter : 144
flow sampler : 48
flow sampler algorithm export : 49
flow sampler interval : 50
flow sampler name : 84
flow class : 51
v9-scope system : 1
v9-scope interface : 2
v9-scope linecard : 3
v9-scope cache : 4
v9-scope template : 5
counter flows : 3
counter bytes : 1
counter bytes long : 1
counter packets : 2
counter packets long : 2
counter bytes squared long : 198
counter bytes permanent : 85
counter packets permanent : 86
counter bytes squared permanent : 199
counter bytes exported : 40
counter packets exported : 41
counter flows exported : 42
timestamp sys-uptime first : 22
timestamp sys-uptime last : 21
The following example displays the status and statistics for all of the flow exporters configured on a router:
Router# show flow exporter name FLOW-MONITOR-1 statistics
Flow Exporter FLOW-MONITOR-1:
Packet send statistics:
Ok 0
No FIB 0
Adjacency failure 0
Enqueued to process level 488
Enqueueing failed 0
IPC failed 0
Output failed 0
Fragmentation failed 0
Encap fixup failed 0
No destination address 0
Client send statistics:
Client: Flow Monitor FLOW-MONITOR-1
Records added 558
Packets sent 486 (51261 bytes)
Packets dropped 0 (0 bytes)
No Packet available errors 0
Table 11 describes the significant fields shown in the display.
The following example displays the template format for the exporters configured on the router. This output will vary according to the flow record configured:
Router# show flow exporter FLOW_EXPORTER-1 templates
Flow Exporter FLOW-MONITOR-1:
Client: Flow Monitor FLOW-MONITOR-1
Exporter Format: NetFlow Version 9
Template ID : 256
Record Size : 53
Template layout
_____________________________________________________________________
| Field | Type1 | Offset2 | Size3 |
---------------------------------------------------------------------
| ipv4 source address | 8 | 0 | 4 |
| ipv4 destination address | 12 | 4 | 4 |
| interface input snmp | 10 | 8 | 4 |
| flow sampler | 48 | 12 | 4 |
| transport source-port | 7 | 16 | 2 |
| transport destination-port | 11 | 18 | 2 |
| ip tos | 194 | 20 | 1 |
| ip protocol | 4 | 21 | 1 |
| ipv4 source mask | 9 | 22 | 1 |
| ipv4 destination mask | 13 | 23 | 1 |
| transport tcp flags | 6 | 24 | 1 |
| routing source as | 16 | 25 | 2 |
| routing destination as | 17 | 27 | 2 |
| routing next-hop address ipv4 | 15 | 29 | 4 |
| interface output snmp | 14 | 33 | 4 |
| counter bytes | 1 | 37 | 4 |
| counter packets | 2 | 41 | 4 |
| timestamp sys-uptime first | 22 | 45 | 4 |
| timestamp sys-uptime last | 21 | 49 | 4 |
---------------------------------------------------------------------
1The field type from the display output of the show flow exporter export-ids netflow-v9 command.
2Where this field is located in the flow record.
3Size of the field in octets (8-bit bytes).
Related Commands
|
|
|
|---|---|
clear flow exporter |
Clears the statistics for exporters. |
debug flow exporter |
Enables debugging output for flow exporters. |
flow exporter |
Creates a flow exporter. |
show flow interface
To display the Flexible NetFlow configuration and status for an interface, use the show flow interface command in privileged EXEC mode.
show flow interface [type number]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Examples
The following example displays the Flexible NetFlow accounting configuration on Ethernet interfaces 0/0 and 0/1:
Router# show flow interface ethernet 1/0
Interface Ethernet1/0
FNF: monitor: FLOW-MONITOR-1
direction: Output
traffic(ip): on
Router# show flow interface ethernet 0/0
Interface Ethernet0/0
FNF: monitor: FLOW-MONITOR-1
direction: Input
traffic(ip): sampler SAMPLER-2#
Table 12 describes the significant fields shown in the display.
Related Commands
|
|
|
|---|---|
show flow monitor |
Displays flow monitor status and statistics. |
show flow monitor
To display the status and statistics for a Flexible NetFlow flow monitor, use the show flow monitor command in privileged EXEC mode.
show flow monitor [[name] monitor-name [cache [format {csv | record | table}]] [statistics]]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
The cache keyword uses the table format by default.
The uppercase field names in the display output of the show flow monitor monitor-name cache command are key fields that Flexible NetFlow uses to differentiate flows. The lowercase field names in the display output of the show flow monitor monitor-name cache command are nonkey fields from which Flexible NetFlow collects values as additional data for the cache.
Examples
The following example displays the status for a flow monitor:
Router# show flow monitor FLOW-MONITOR-1
Flow Monitor FLOW-MONITOR-1:
Description: Used for basic traffic analysis
Flow Record: netflow-original
Flow Exporter: EXP-DC-TOPEKA
EXP-DC-PHOENIX
Cache:
Type: normal
Status: allocated
Size: 4096 entries / 311316 bytes
Inactive Timeout: 15 secs
Active Timeout: 1800 secs
Update Timeout: 1800 secs
Table 13 describes the significant fields shown in the display.
The following example displays the status, statistics, and data for the flow monitor named FLOW-MONITOR-1:
Router# show flow monitor FLOW-MONITOR-1 cache
Cache type: Normal
Cache size: 4096
Current entries: 8
High Watermark: 10
Flows added: 1560
Flows aged: 1552
- Active timeout ( 1800 secs) 24
- Inactive timeout ( 15 secs) 1528
- Event aged 0
- Watermark aged 0
- Emergency aged 0
IP TOS: 0x00
IP PROTOCOL: 6
IPV4 SOURCE ADDRESS: 10.10.10.2
IPV4 DESTINATION ADDRESS: 172.16.10.2
TRNS SOURCE PORT: 20
TRNS DESTINATION PORT: 20
INTERFACE INPUT: Et0/0
FLOW SAMPLER ID: 0
ip source as: 0
ip destination as: 0
ipv4 next hop address: 172.16.7.2
ipv4 source mask: /0
ipv4 destination mask: /24
tcp flags: 0x00
interface output: Et1/0
counter bytes: 198520
counter packets: 4963
timestamp first: 10564356
timestamp last: 12154104
Table 14 describes the significant fields shown in the display.
The following example displays the status, statistics, and data for the flow monitor named FLOW-MONITOR-1 in a table format:
Router# show flow monitor FLOW-MONITOR-1 cache format table
Cache type: Normal
Cache size: 4096
Current entries: 4
High Watermark: 6
Flows added: 90
Flows aged: 86
- Active timeout ( 1800 secs) 0
- Inactive timeout ( 15 secs) 86
- Event aged 0
- Watermark aged 0
- Emergency aged 0
IP TOS IP PROT IPV4 SRC ADDR IPV4 DST ADDR TRNS SRC PORT TRNS DST PORT
====== ======= =============== =============== ============= ==============
0x00 1 10.251.10.1 172.16.10.2 0 02
0x00 1 10.251.10.1 172.16.10.2 0 20484
0xC0 17 172.16.6.1 224.0.0.9 520 5202
0x00 6 10.10.11.1 172.16.10.5 25 252
Router#
The following example displays the status, statistics, and data for the flow monitor named FLOW-MONITOR-IPv6 (the cache contains IPv6 data) in record format:
Router# show flow monitor name FLOW-MONITOR-IPv6 cache format record
Cache type: Normal
Cache size: 4096
Current entries: 6
High Watermark: 8
Flows added: 1048
Flows aged: 1042
- Active timeout ( 1800 secs) 11
- Inactive timeout ( 15 secs) 1031
- Event aged 0
- Watermark aged 0
- Emergency aged 0
IPV6 FLOW LABEL: 0
IPV6 EXTENSION MAP: 0x00000040
IPV6 SOURCE ADDRESS: 2001:DB8:1:ABCD::1
IPV6 DESTINATION ADDRESS: 2001:DB8:4:ABCD::2
TRNS SOURCE PORT: 3000
TRNS DESTINATION PORT: 55
INTERFACE INPUT: Et0/0
FLOW DIRECTION: Input
FLOW SAMPLER ID: 0
IP PROTOCOL: 17
IP TOS: 0x00
ip source as: 0
ip destination as: 0
ipv6 next hop address: ::
ipv6 source mask: /48
ipv6 destination mask: /0
tcp flags: 0x00
interface output: Null
counter bytes: 521192
counter packets: 9307
timestamp first: 9899684
timestamp last: 11660744
Table 15 describes the significant fields shown in the display.
The following example displays the status and statistics for a flow monitor:
Router# show flow monitor FLOW-MONITOR-1 statistics
Cache type: Normal
Cache size: 4096
Current entries: 4
High Watermark: 6
Flows added: 116
Flows aged: 112
- Active timeout ( 1800 secs) 0
- Inactive timeout ( 15 secs) 112
- Event aged 0
- Watermark aged 0
- Emergency aged 0
Table 16 describes the significant fields shown in the display.
Related Commands
|
|
|
|---|---|
clear flow monitor |
Clears the flow monitor. |
debug flow monitor |
Enables debugging output for flow monitors. |
show flow monitor cache aggregate
To display aggregated flow statistics from a flow monitor cache, use the show flow monitor cache aggregate command in privileged EXEC mode.
show flow monitor [name] monitor-name cache aggregate {{options [...options] [collect options [...options]] | record record-name} [format {csv | record | table}]}
Syntax Description
name |
(Optional) Specifies the name of a flow monitor. |
monitor-name |
Name of a flow monitor that was previously configured. |
options |
Fields upon which aggregation is performed; and from which additional data from the cache is displayed when the collect keyword is used. You can specify multiple values for the options argument. See the "Aggregation options Argument" section in the "Usage Guidelines" section. |
collect |
(Optional) Displays additional data from the cache. See the "Cache Data Fields Displayed" section in the "Usage Guidelines" section. |
record record-name |
Specifies the name of a user-defined flow record or a predefined flow record. See Table 17 for a listing of the available predefined records and their definitions. |
format |
(Optional) Specifies the use of one of the format options for formatting the display output. |
csv |
Displays the flow monitor cache contents in comma-separated variables (CSV) format. |
record |
Displays the flow monitor cache contents in record format. |
table |
Displays the flow monitor cache contents in table format. |
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Flexible Netflow - Top N Talkers Support
The show flow monitor cache aggregate command is one of a set of three commands that make up the Flexible Netflow—Top N Talkers Support feature. The Flexible Netflow—Top N Talkers Support feature is used to manipulate the display output from the Flexible NetFlow cache to facilitate the analysis of network traffic.
The other two commands that make up the Flexible Netflow—Top N Talkers Support feature are show flow monitor cache filter and show flow monitor cache sort. The three commands can be used together or on their own, depending on your requirements. For more detailed information about these commands, see the show flow monitor cache filter command and the show flow monitor cache sort command. For information about how the three commands are used together, refer to the "Configuring Cisco IOS Flexible Netflow—Top N Talkers Support" module in the Configuring Cisco IOS Flexible Netflow Configuration Guide.
Flow Aggregation
Flow aggregation using the show flow monitor cache aggregate command allows you to dynamically display the flow information in a cache using a different flow record than the cache was originally created from. Only the fields in the cache will be available for the aggregated flows.
Note The key and nonkey fields in the flows are defined in the flow record that you assigned to the flow monitor from which the cache data is being aggregated.
Aggregation helps you achieve a higher-level view of the traffic in your network by combining flow data from multiple flows based on the criteria that interest you, for example, displaying flow data for:
•All the HTTP traffic in your network.
•All the traffic being forwarded to a specific Border Gateway Protocol (BGP) next-hop.
•Identifying a device that is sending several types of traffic to one or more hosts in your network, perhaps as part of a denial of service (DoS) attack.
Aggregation options Argument
The options that you can use for the options argument of the show flow monitor cache aggregate command are dependent on the fields that are used for the user-defined flow record that you configured for the flow monitor using the record command. To identify the options that you can use, use the show flow record record-name command in privileged EXEC mode, where record-name is the name of the record that you configured for the flow monitor.
For example, if you assigned the "NetFlow Original" predefined record to a flow monitor, you use the show flow record netflow-original command to display its key (match) and nonkey (collect) fields. The following is partial output from the show flow record netflow-original command:
flow record netflow-original:
Description: Traditional IPv4 input NetFlow with origin ASs
No. of users: 2
Total field space: 53 bytes
Fields:
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
.
.
.
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
The fields from this partial output that you can use for the option argument follow the match (key fields) and collect (nonkey fields) words. For example, you can use the "ipv4 tos" field to aggregate the flows as shown in the first example in the "Examples" section.
Cache Data Fields Displayed
By default the data fields from the cache that are shown in the display output of the show flow monitor cache aggregate command are limited to the field used for aggregation and the counter fields such as flows, number of bytes, and the number of packets. The following is partial output from the show flow monitor FLOW-MONITOR-3 cache aggregate ipv4 destination address command:
IPV4 DST ADDR flows bytes pkts
=============== ========== ========== ==========
224.192.16.1 2 97340 4867
224.192.18.1 3 96080 4804
224.192.16.4 4 79760 3988
224.192.45.12 3 77480 3874
255.255.255.255 1 52 1
Notice that the data contains only the IPv4 destination addresses for which flows have been aggregated and the counter values.
The flow monitor (FLOW-MONITOR-3) referenced by the show flow monitor FLOW-MONITOR-3 cache aggregate ipv4 destination address command uses the "NetFlow Original" predefined record, which contains the following key and nonkey fields:
•match ipv4 tos
•match ipv4 protocol
•match ipv4 source address
•match ipv4 destination address
•match transport source-port
•match transport destination-port
•match interface input
•match flow sampler
•collect routing source as
•collect routing destination as
•collect routing next-hop address ipv4
•collect ipv4 source mask
•collect ipv4 destination mask
•collect transport tcp flags
•collect interface output
•collect counter bytes
•collect counter packets
•collect timestamp sys-uptime first
•collect timestamp sys-uptime last
The collect keyword is used to include additional cache data in the display output of the show flow monitor cache aggregate command. The following partial output from the show flow monitor FLOW-MONITOR-3 cache aggregate ipv4 destination address collect transport tcp flags command shows the transport TCP flags data from the cache:
IPV4 DST ADDR tcp flags flows bytes pkts
=============== ========= ========== ========== ==========
224.192.16.1 0x00 4 165280 8264
224.192.18.1 0x00 4 158660 7933
224.192.16.4 0x00 3 146740 7337
224.192.45.12 0x00 4 145620 7281
255.255.255.255 0x00 1 52 1
224.0.0.13 0x00 1 54 1
You can add cache data fields after the collect keyword to show additional data from the cache in the display output of the show flow monitor cache aggregate command.
Keywords and Descriptions for the record Argument
Table 17 describes the keywords for the record argument.
Examples
The following example aggregates the flow monitor cache data on the IPv4 ToS value:
Router# show flow monitor FLOW-MONITOR-2 cache aggregate ipv4 tos
Processed 12 flows
Aggregated to 3 flows
IP TOS flows bytes pkts
====== ========== ========== ==========
0x90 6 706800 35340
0xC8 4 345192 42871
0xAC 2 7865 342
The following example aggregates the flow monitor cache data on the IPv4 destination address and displays the cache data for the IPv4 protocol type and input interface nonkey fields:
Router# show flow monitor FLOW-MONITOR-3 cache aggregate ipv4 destination address collect
ipv4 protocol interface input
Processed 17 flows
Aggregated to 7 flows
IPV4 DST ADDR intf input flows bytes pkts ip prot
=============== ==================== ========== ========== ========== =======
224.192.16.4 Et0/0 3 42200 2110 1
224.192.16.1 Et0/0 3 17160 858 1
224.192.18.1 Et0/0 4 18180 909 1
224.192.45.12 Et0/0 4 14440 722 1
255.255.255.255 Et0/0 1 52 1 17
224.0.0.13 Et0/0 1 54 1 103
224.0.0.1 Et0/0 1 28 1 2
The following example aggregates the flow monitor cache data on the destination and source IPv4 addresses:
Router# show flow monitor FLOW-MONITOR-1 cache aggregate ipv4 destination address ipv4
source address
Processed 26 flows
Aggregated to 17 flows
IPV4 SRC ADDR IPV4 DST ADDR flows bytes pkts
=============== =============== ========== ========== ==========
10.251.10.1 172.16.10.2 2 1400828 1364
192.168.67.6 172.16.10.200 1 19096 682
10.234.53.1 172.16.10.2 3 73656 2046
172.30.231.193 172.16.10.2 3 73616 2045
10.10.10.2 172.16.10.2 2 54560 1364
192.168.87.200 172.16.10.2 2 54560 1364
10.10.10.4 172.16.10.4 1 27280 682
10.10.11.1 172.16.10.5 1 27280 682
10.10.11.2 172.16.10.6 1 27280 682
10.10.11.3 172.16.10.7 1 27280 682
10.10.11.4 172.16.10.8 1 27280 682
10.1.1.1 172.16.10.9 1 27280 682
10.1.1.2 172.16.10.10 1 27280 682
10.1.1.3 172.16.10.11 1 27280 682
172.16.1.84 172.16.10.19 2 54520 1363
172.16.1.85 172.16.10.20 2 54520 1363
172.16.6.1 224.0.0.9 1 52 1
Related Commands
show flow monitor cache filter
To filter the display output of statistics from the flows in a flow monitor cache, use the show flow monitor cache filter command in privileged EXEC mode.
show flow monitor [name] monitor-name cache filter options [regexp regexp] [...options [regexp regexp]] [format {csv | record | table}]
Syntax Description
name |
(Optional) Specifies the name of a flow monitor. |
monitor-name |
Name of a flow monitor that was previously configured. |
options |
Fields upon which filtering is performed. You can specify multiple values for the options argument. See the "Filter options Argument" section in the "Usage Guidelines" section. |
regexp regexp |
(Optional) Match the field specified with the options argument against a regular expression. See the "Regular Expressions" section in the "Usage Guidelines" section. |
format |
(Optional) Specifies the use of one of the format options for formatting the display output. |
csv |
Displays the flow monitor cache contents in comma-separated variables (CSV) format. |
record |
Displays the flow monitor cache contents in record format. |
table |
Displays the flow monitor cache contents in table format. |
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Flexible Netflow—Top N Talkers Support
The show flow monitor cache filter command is one of a set of three commands that make up the Flexible Netflow—Top N Talkers Support feature. The Flexible Netflow—Top N Talkers Support feature is used to manipulate the display output from the Flexible NetFlow cache to facilitate the analysis of network traffic.
The other two commands that make up the Flexible Netflow—Top N Talkers Support feature are show flow monitor cache sort and show flow monitor cache aggregate. The three commands can be used together or on their own, depending on your requirements. For more detailed information about these commands, see the show flow monitor cache sort command and the show flow monitor cache aggregate command. For information about how the three commands are used together, refer to the "Configuring Cisco IOS Flexible Netflow—Top N Talkers Support" module in the Configuring Cisco IOS Flexible Netflow Configuration Guide.
Filter options Argument
The options that you can use for the options argument of the show flow monitor cache filter command are dependent on the fields that are used for the record that you configured for the flow monitor using the record command. To identify the options that you can use, use the show flow record record-name command in privileged EXEC mode, where record-name is the name of the record that you configured for the flow monitor.
For example, if you assigned the "NetFlow Original" predefined record to a flow monitor, you use the show flow record netflow-original command to display its key (match) and nonkey (collect) fields. The following is partial output from the show command:
flow record netflow-original:
Description: Traditional IPv4 input NetFlow with origin ASs
No. of users: 2
Total field space: 53 bytes
Fields:
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
.
.
.
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
The fields from this partial output that you can use for the option argument follow the match (key fields) and collect (nonkey fields) words. For example, you can use the "ipv4 tos" field to filter the flows as shown in the first example in the "Examples" section.
Filtering Criteria
The following are examples of the types of filtering criteria available for the show flow monitor cache filter command:
•Perform an exact match on any numerical fields in either decimal or hexadecimal format. For example, these two commands match flows in the flow monitor cache that contain either" 0xA001" or "1" :
–show flow monitor FLOW-MONITOR-1 cache filter transport source-port 0xA001
–show flow monitor FLOW-MONITOR-1 cache filter transport source-port 1
•Perform a match on a range for any numerical fields in either decimal or hexadecimal format. For example, these two commands match flows in the flow monitor cache that contain either "0xA000 0xB000" or "1 1024":
–show flow monitor FLOW-MONITOR-1 cache filter transport source-port 0xA000 0xB000
–show flow monitor FLOW-MONITOR-1 cache filter transport source-port 1 1024
•Perform an exact match for any alphanumerical field. For example, this command matches flows in the flow monitor cache having a MAC address of ABCD:0012:01FE:
–show flow monitor FLOW-MONITOR-1 cache filter datalink mac source address ABCD:0012:01FE
•Perform a regular-expression match on any alphanumerical field. For example, this command matches flows in the flow monitor cache having a MAC address that starts with ABCD:
–show flow monitor FLOW-MONITOR-1 cache filter datalink mac source address regexp ABCD:*
•Perform a match on flag fields with an implicit <and>. For example, this command matches flows in the flow monitor cache that contain the urg and syn TCP flags:
–show flow monitor FLOW-MONITOR-1 cache filter transport tcp flags urg syn
•Perform a match against flags that are not present. For example, this command matches flows in the flow monitor cache that contain the syn and rst TCP flags and do not contain the urg and fin TCP flags. :
–show flow monitor FLOW-MONITOR-1 cache filter transport tcp flags syn rst not urg fin
•Perform an exact match on an IP address field. For example, this command matches flows in the flow monitor cache that contain the source IPv4 address "192.168.0.1" :
–show flow monitor FLOW-MONITOR-1 cache filter ipv4 source address 192.168.0.1
•Perform a prefix match on an IPv4 or IPv6 address field. For example, these two commands match flows in the flow monitor cache that contain either "192.168.0.0 255.255.0.0" or "7:20ac::/64":
–show flow monitor FLOW-MONITOR-1 cache filter ipv4 source address 192.168.0.0 255.255.0.0
–show flow monitor FLOW-MONITOR-1 cache filter ipv6 source address 7:20ac::/64
•Perform a match on a range of relative time stamps. For example, this command matches flows in the flow monitor cache that were created within the last "500" seconds:
–show flow monitor FLOW-MONITOR-1 cache filter timestamp sys-uptime first 0 500 seconds
•Perform a match on range of the time stamp that is configured (uptime or absolute). For example, this command matches flows in the flow monitor cache that were created between 0800 and 0815, within the last 24 hours:
–show flow monitor FLOW-MONITOR-1 cache filter timestamp sys-uptime last 08:00:00 08:15:00 t
•Perform an exact match on an interface. For example, this command matches flows in the flow monitor cache which are received on Ethernet interface 0/0.
–show flow monitor FLOW-MONITOR-1 cache filter interface input Ethernet0/0
•Perform a regular-expression match on an interface. For example, this command matches flows in the flow monitor cache that begin with Ethernet0/ and have either "1", "2", or "3" as the port number:
–show flow monitor FLOW-MONITOR-1 cache filter interface input regexp Ethernet0/1
Regular Expressions
Table 18 shows the syntax for regular expressions.
Examples
The following example filters the flow monitor cache data on the IPv4 type of service (ToS) value:
Router# show flow monitor FLOW-MONITOR-3 cache filter ipv4 tos regexp 0x(C0|50)
Cache type: Normal
Cache size: 4096
Current entries: 19
High Watermark: 38
Flows added: 3516
Flows aged: 3497
- Active timeout ( 1800 secs) 52
- Inactive timeout ( 15 secs) 3445
- Event aged 0
- Watermark aged 0
- Emergency aged 0
IPV4 SOURCE ADDRESS: 10.1.1.1
IPV4 DESTINATION ADDRESS: 255.255.255.255
TRNS SOURCE PORT: 520
TRNS DESTINATION PORT: 520
INTERFACE INPUT: Et0/0
FLOW SAMPLER ID: 0
IP TOS: 0xC0
IP PROTOCOL: 17
ip source as: 0
ip destination as: 0
ipv4 next hop address: 0.0.0.0
ipv4 source mask: /24
ipv4 destination mask: /0
tcp flags: 0x00
interface output: Null
counter bytes: 52
counter packets: 1
timestamp first: 18:59:46.199
timestamp last: 18:59:46.199
Matched 1 flow
The following example filters the flow monitor cache data on the source IPv4 address of 10.234.53.1:
Router# show flow monitor FLOW-MONITOR-1 cache filter ipv4 source address 10.234.53.1
Cache type: Normal
Cache size: 4096
Current entries: 26
High Watermark: 26
Flows added: 87
Flows aged: 61
- Active timeout ( 1800 secs) 0
- Inactive timeout ( 15 secs) 61
- Event aged 0
- Watermark aged 0
- Emergency aged 0
IPV4 SOURCE ADDRESS: 10.234.53.1
IPV4 DESTINATION ADDRESS: 172.16.10.2
TRNS SOURCE PORT: 0
TRNS DESTINATION PORT: 2048
INTERFACE INPUT: Et0/0.1
FLOW SAMPLER ID: 0
IP TOS: 0x00
IP PROTOCOL: 1
ip source as: 0
ip destination as: 0
ipv4 next hop address: 172.16.7.2
ipv4 source mask: /0
ipv4 destination mask: /24
tcp flags: 0x00
interface output: Et1/0.1
counter bytes: 24724
counter packets: 883
timestamp first: 16:03:56.007
timestamp last: 16:27:07.063
IPV4 SOURCE ADDRESS: 10.234.53.1
IPV4 DESTINATION ADDRESS: 172.16.10.2
TRNS SOURCE PORT: 20
TRNS DESTINATION PORT: 20
INTERFACE INPUT: Et0/0.1
FLOW SAMPLER ID: 0
IP TOS: 0x00
IP PROTOCOL: 6
ip source as: 0
ip destination as: 0
ipv4 next hop address: 172.16.7.2
ipv4 source mask: /0
ipv4 destination mask: /24
tcp flags: 0x00
interface output: Et1/0.1
counter bytes: 35320
counter packets: 883
timestamp first: 16:03:56.267
timestamp last: 16:27:07.323
IPV4 SOURCE ADDRESS: 10.234.53.1
IPV4 DESTINATION ADDRESS: 172.16.10.2
TRNS SOURCE PORT: 21
TRNS DESTINATION PORT: 21
INTERFACE INPUT: Et0/0.1
FLOW SAMPLER ID: 0
IP TOS: 0x00
IP PROTOCOL: 6
ip source as: 0
ip destination as: 0
ipv4 next hop address: 172.16.7.2
ipv4 source mask: /0
ipv4 destination mask: /24
tcp flags: 0x00
interface output: Et1/0.1
counter bytes: 35320
counter packets: 883
timestamp first: 16:03:56.327
timestamp last: 16:27:07.363
Matched 3 flows
The following example uses multiple filtering criteria to filter the cache data on the IPv4 destination address and the destination port:
Router# show flow monitor FLOW-MONITOR-1 cache filter ipv4 destination address regexp
172.16.10* transport destination-port 21
Cache type: Normal
Cache size: 4096
Current entries: 26
High Watermark: 26
Flows added: 241
Flows aged: 215
- Active timeout ( 1800 secs) 50
- Inactive timeout ( 15 secs) 165
- Event aged 0
- Watermark aged 0
- Emergency aged 0
IPV4 SOURCE ADDRESS: 10.10.10.2
IPV4 DESTINATION ADDRESS: 172.16.10.2
TRNS SOURCE PORT: 21
TRNS DESTINATION PORT: 21
INTERFACE INPUT: Et0/0.1
FLOW SAMPLER ID: 0
IP TOS: 0x00
IP PROTOCOL: 6
ip source as: 0
ip destination as: 0
ipv4 next hop address: 172.16.7.2
ipv4 source mask: /0
ipv4 destination mask: /24
tcp flags: 0x00
interface output: Et1/0.1
counter bytes: 17200
counter packets: 430
timestamp first: 17:03:58.071
timestamp last: 17:15:14.615
IPV4 SOURCE ADDRESS: 172.30.231.193
IPV4 DESTINATION ADDRESS: 172.16.10.2
TRNS SOURCE PORT: 21
TRNS DESTINATION PORT: 21
INTERFACE INPUT: Et0/0.1
FLOW SAMPLER ID: 0
IP TOS: 0x00
IP PROTOCOL: 6
ip source as: 0
ip destination as: 0
ipv4 next hop address: 172.16.7.2
ipv4 source mask: /0
ipv4 destination mask: /24
tcp flags: 0x00
interface output: Et1/0.1
counter bytes: 17160
counter packets: 429
timestamp first: 17:03:59.963
timestamp last: 17:15:14.887
Matched 2 flows
Related Commands
show flow monitor cache sort
To sort the display output of statistics from the flows in a flow monitor cache, use the show flow monitor cache sort command in privileged EXEC mode.
show flow monitor [name] monitor-name cache sort options [top [number]] [format {csv | record | table}]
Syntax Description
name |
(Optional) Specifies the name of a flow monitor. |
monitor-name |
Name of a flow monitor that was previously configured. |
options |
Fields upon which aggregation can be performed. See the "Sort options Argument" section in the "Usage Guidelines" section. |
top |
(Optional) Limits the display output to the 20 highest volume flows (top talkers) unless overridden by the specification of a value for the number argument. |
number |
(Optional) Overrides the default value of top talkers to display. |
format |
(Optional) Specifies the use of one of the format options for formatting the display output. |
csv |
Displays the flow monitor cache contents in comma-separated variables (CSV) format. |
record |
Displays the flow monitor cache contents in record format. |
table |
Displays the flow monitor cache contents in table format. |
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Flexible Netflow—Top N Talkers Support
The show flow monitor cache sort command is one of a set of three commands that make up the Flexible Netflow—Top N Talkers Support feature. The Flexible Netflow—Top N Talkers Support feature is used to manipulate the display output from the Flexible NetFlow cache to facilitate the analysis of network traffic.
The other two commands that make up the Flexible Netflow—Top N Talkers Support feature are show flow monitor cache filter and show flow monitor cache aggregate. The three commands can be used together or on their own, depending on your requirements. For more detailed information about these commands, see the show flow monitor cache filter command and the show flow monitor cache aggregate command. For information about how the three commands are used together, refer to the "Configuring Cisco IOS Flexible Netflow—Top N Talkers Support" module in the Configuring Cisco IOS Flexible Netflow Configuration Guide.
Flow Sorting
The flow sorting function of the Flexible Netflow—Top N Talkers Support feature sorts flow data from the Flexible NetFlow cache based on the criteria that you specify, and displays the data. You can also use the flow sorting function of the Flexible Netflow—Top N Talkers Support feature to limit the display output to a specific number of entries (Top N Talkers) by using the top keyword.
Sort options Argument
The options that you can use for the options argument of the show flow monitor cache filter command are dependent on the fields that are used for the record that you configured for the flow monitor using the record command. To identify the options that you can use, use the show flow record record-name command in privileged EXEC mode, where record-name is the name of the record that you configured for the flow monitor.
For example, if you assigned the "NetFlow Original" predefined record to a flow monitor, you use the show flow record netflow-original command to display its key (match) and nonkey (collect) fields. The following is partial output from the show command:
flow record netflow-original:
Description: Traditional IPv4 input NetFlow with origin ASs
No. of users: 2
Total field space: 53 bytes
Fields:
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
.
.
.
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
The fields from this partial output that you can use for the option argument follow the match (key fields) and collect (nonkey fields) words. For example, you can use the "ipv4 tos" field to sort the flows as shown in the first example in the "Examples" section.
Examples
The following example sorts the flow monitor cache data on the IPv4 type of service (ToS) value and limits the display output to the top two flows:
Router# show flow monitor FLOW-MONITOR-3 cache sort ipv4 tos top 2
Processed 17 flows
Aggregated to 17 flows
Showing the top 2 flows
IPV4 SOURCE ADDRESS: 10.1.1.1
IPV4 DESTINATION ADDRESS: 224.192.16.1
TRNS SOURCE PORT: 0
TRNS DESTINATION PORT: 3073
INTERFACE INPUT: Et0/0
FLOW SAMPLER ID: 0
IP TOS: 0x55
IP PROTOCOL: 1
ip source as: 0
ip destination as: 0
ipv4 next hop address: 0.0.0.0
ipv4 source mask: /24
ipv4 destination mask: /0
tcp flags: 0x00
interface output: Null
counter bytes: 33680
counter packets: 1684
timestamp first: 18:39:27.563
timestamp last: 19:04:28.459
IPV4 SOURCE ADDRESS: 10.1.1.1
IPV4 DESTINATION ADDRESS: 224.192.16.1
TRNS SOURCE PORT: 0
TRNS DESTINATION PORT: 0
INTERFACE INPUT: Et0/0
FLOW SAMPLER ID: 0
IP TOS: 0x55
IP PROTOCOL: 1
ip source as: 0
ip destination as: 0
ipv4 next hop address: 0.0.0.0
ipv4 source mask: /24
ipv4 destination mask: /0
tcp flags: 0x00
interface output: Et3/0.1
counter bytes: 145040
counter packets: 7252
timestamp first: 18:42:34.043
timestamp last: 19:04:28.459
The following example displays the top three flows from the cache sorted on the IPv4 destination addresses from lowest to highest (no aggregation is performed):
Router# show flow monitor FLOW-MONITOR-1 cache sort lowest ipv4 destination address top 3
Processed 10 flows
Aggregated to 10 flows
Showing the top 3 flows
IPV4 SOURCE ADDRESS: 10.1.4.2
IPV4 DESTINATION ADDRESS: 10.1.2.2
datalink dot1q vlan output: 0
datalink mac source address input: AABB.CC00.2300
datalink mac source address output: AABB.CC00.2001
datalink mac destination address input: AABB.CC00.2003
flow direction: Output
counter bytes: 50511396
counter packets: 35558
IPV4 SOURCE ADDRESS: 10.1.4.2
IPV4 DESTINATION ADDRESS: 10.1.3.2
datalink dot1q vlan output: 0
datalink mac source address input: AABB.CC00.2300
datalink mac source address output: AABB.CC00.2002
datalink mac destination address input: AABB.CC00.2003
flow direction: Output
counter bytes: 1154150
counter packets: 787
IPV4 SOURCE ADDRESS: 10.1.2.2
IPV4 DESTINATION ADDRESS: 10.1.4.2
datalink dot1q vlan output: 15
datalink mac source address input: AABB.CC00.2100
datalink mac source address output: AABB.CC00.2003
datalink mac destination address input: AABB.CC00.2001
flow direction: Output
counter bytes: 50750405
counter packets: 35722
Related Commands
show flow record
To display the status and statistics for a Flexible NetFlow flow record, use the show flow record command in privileged EXEC mode.
show flow record [[name] record-name | netflow-original | netflow {ipv4 | ipv6} record [peer]]
Cisco Catalyst 6500 Switches in Cisco IOS Release 12.2(50)SY
show flow record [[name] record-name | platform-original {ipv4 | ipv6} record]
Syntax Description
name |
(Optional) Specifies the name of a flow record. |
record-name |
(Optional) Name of a user-defined flow record that was previously configured. |
netflow-original |
(Optional) Specifies the Flexible NetFlow implementation of original NetFlow with origin autonomous systems. |
netflow ipv4 |
(Optional) Configures the flow monitor to use one of the IPv4 predefined records. |
netflow ipv6 |
(Optional) Configures the flow monitor to use one of the IPv6 predefined records. |
record |
(Optional) Name of the predefined record. See Table 19 for a listing of the available records and their definitions. |
peer |
(Optional) Configures the flow monitor to use one of the predefined records with peer autonomous systems. The peer keyword is not supported for every type of Flexible NetFlow predefined record. See Table 19. |
platform-original ipv4 |
Configures the flow monitor to use one of the predefined IPv4 records. |
platform-original ipv6 |
Configures the flow monitor to use one of the predefined IPv6 records. |
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Table 19 describes the keywords and descriptions for the record argument.
Examples
The following example displays the status and statistics for the original Flexible NetFlow record:
Router# show flow record FLOW-RECORD-1 platform-original ipv4 destination
flow record FLOW_RECORD-1:
Description: Flow Record for IPv4 traffic
No. of users: 3
Total field space: 53 bytes
Fields:
match interface input
match transport destination-port
match transport source-port
match ipv4 destination address
match ipv4 source address
match ipv4 protocol
match ipv4 tos
collect counter bytes
collect counter packets
collect timestamp sys-uptime last
collect timestamp sys-uptime first
collect ipv4 destination mask
collect ipv4 source mask
collect routing destination as
collect routing source as
collect transport tcp flags
collect routing next-hop address ipv4
collect interface output
Table 20 describes the significant fields shown in the display.
Related Commands
|
|
|
|---|---|
record |
Configures a flow record for a flow monitor. |
show platform flow
To display information for Flexible NetFlow platform parameters. use the show platform flow command in privileged EXEC mode.
show platform flow [aging | {export | usage | table-contention {aggregate | detailed | summary} }[instance | module] | {ip | ipv6} [count | destination | instance | module | multicast | protocol | source] | {layer2 | mpls } [count | instance | module]]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
|
|
|
|---|---|
12.2(50)SY |
This command was introduced. |
Examples
The following example displays Flexible NetFlow parameter export information:
Router# show platform flow export
Yielding NDE is enabled.
Supervisor CPU threshold = 25
Linecard CPU threshold = 25
Module 3:
----------
No of flows read and exported = 0
No of flows discarded = 0
No of capture+purge requests = 1695104
No of purge-only requests = 19
Module 5:
----------
No of flows read and exported = 0
No of flows discarded = 0
No of capture+purge requests = 1695158
No of purge-only requests = 0
lionel#
Table 21 describes the significant fields shown in the display.
Related Commands
|
|
|
|---|---|
flow hardware |
Configures Flexible NetFlow hardware parameters. |
flow platform |
Configures Flexible NetFlow platform parameters. |
show sampler
To display the status and statistics for a Flexible NetFlow sampler, use the show sampler command in privileged EXEC mode.
show sampler [[name] sampler-name]
Syntax Description
name |
(Optional) Specifies the name of a flow sampler. |
sampler-name |
(Optional) Name of a sampler that was previously configured. |
Command Modes
Privileged EXEC (#)
Command History
Examples
The following example displays the status and statistics for all of the flow samplers configured:
Router# show sampler
Sampler SAMPLER-1:
ID: 1
Description: User defined
Type: random
Rate: 1 out of 3
Samples: 189
Requests: 23243
Users (2):
flow monitor FLOW-MONITOR-1 (ip,Et0/0,Input) 65 out of 10786
flow monitor FLOW-MONITOR-2 (ipv6,Et0/0, Input) 124 out of 12457
Sampler sampler-2:
ID: 2
Description: User defined
Type: deterministic
Rate: 1 out of 100
Samples: 1
Requests: 124
Users (1):
flow monitor FLOW-MONITOR-1 (ip,Et0/0,Input) 1 out of 124
Table 22 describes the significant fields shown in the display.
Related Commands
|
|
|
|---|---|
clear sampler |
Clears the flow sampler statistics. |
debug sampler |
Enables debugging output for flow samplers. |
sampler |
Creates a flow sampler. |
source (Flexible NetFlow)
To configure the source IP address interface for all of the packets sent by a Flexible NetFlow flow exporter, use the source command in Flexible NetFlow flow exporter configuration mode. To remove the source IP address interface for all of the packets sent by a Flexible NetFlow flow exporter, use the no form of this command.
source interface-type interface-number
no source
Syntax Description
Command Default
The IP address of the interface over which the Flexible NetFlow datagram is transmitted is used as the source IP address.
Command Modes
Flexible NetFlow flow exporter configuration (config-flow-exporter)
Command History
Usage Guidelines
The benefits of using a consistent IP source address for the datagrams that NetFlow sends include the following:
•The source IP address of the datagrams exported by Flexible NetFlow is used by the destination system to determine from which router the Flexible NetFlow data is arriving. If your network has two or more paths that can be used to send Flexible NetFlow datagrams from the router to the destination system and you do not specify the source interface from which the source IP address is to be obtained, the router uses the IP address of the interface over which the datagram is transmitted as the source IP address of the datagram. In this situation the destination system might receive Flexible NetFlow datagrams from the same router, but with different source IP addresses. When the destination system receives Flexible NetFlow datagrams from the same router with different source IP addresses, the destination system treats the Flexible NetFlow datagrams as if they were being sent from different routers. To avoid having the destination system treat the Flexible NetFlow datagrams as if they were being sent from different routers, you must configure the destination system to aggregate the Flexible NetFlow datagrams it receives from all of the possible source IP addresses in the router into a single Flexible NetFlow flow.
•If your router has multiple interfaces that can be used to transmit datagrams to the destination system, and you do not configure the source command, you will have to add an entry for the IP address of each interface into any access lists that you create for permitting Flexible NetFlow traffic. Creating and maintaining access lists for permitting Flexible NetFlow traffic from known sources and blocking it from unknown sources is easier when you limit the source IP address for Flexible NetFlow datagrams to a single IP address for each router that is exporting Flexible NetFlow traffic.
The interface that you configure as the
source interface must have an IP address configured, and it must be up.
Tip When a transient outage occurs on the interface that you configured with the source command, the Flexible NetFlow exporter reverts to the default behavior of using the IP address of the interface over which the datagrams are being transmitted as the source IP address for the datagrams. To avoid this problem, use a loopback interface as the source interface because loopback interfaces are not subject to the transient outages that can occur on physical interfaces.
Examples
The following example shows how to configure Flexible NetFlow to use a loopback interface as the source interface for NetFlow traffic:
Router(config)# flow exporter FLOW-EXPORTER-1
Router(config-flow-exporter)# source loopback 0
Related Commands
|
|
|
|---|---|
flow exporter |
Creates a flow exporter. |
statistics packet
To collect protocol distribution statistics and size distribution statistics for a Flexible NetFlow flow monitor, use the statistics packet command in Flexible NetFlow flow monitor configuration mode. To disable collecting protocol distribution statistics and size distribution statistics for a Flexible NetFlow flow monitor, use the no form of this command.
statistics packet {protocol | size}
no statistics packet {protocol | size}
Syntax Description
protocol |
Collects packet protocol distribution statistics. |
size |
Collects packet size distribution statistic. |
Command Default
The collection of protocol distribution statistics and size distribution statistics for a Flexible NetFlow flow monitor is not enabled by default.
Command Modes
Flexible NetFlow flow monitor configuration (config-flow-monitor)
Command History
Examples
The following example enables the collection of protocol distribution statistics for flow monitors:
Router(config)# flow monitor FLOW-MONITOR-1
Router(config-flow-monitor)# statistics packet protocol
The following example enables the collection of size distribution statistics for flow monitors:
Router(config)# flow monitor FLOW-MONITOR-1
Router(config-flow-monitor)# statistics packet size
Related Commands
|
|
|
|---|---|
flow monitor |
Creates a flow monitor. |
template data timeout
To configure the template resend timeout for a Flexible NetFlow flow exporter, use the template data timeout command in Flexible NetFlow flow exporter configuration mode. To remove the template resend timeout for a Flexible NetFlow flow exporter, use the no form of this command.
template data timeout seconds
no template data timeout
Syntax Description
seconds |
Configures resending of templates based on the timeout value in seconds, that you enter. Range: 1 to 86400. Default 600. |
Command Default
The default template resend timeout for a Flexible NetFlow flow exporter is 600 seconds.
Command Modes
Flexible NetFlow flow exporter configuration (config-flow-exporter)
Command History
Examples
The following example configures resending templates based on a timeout of 1000 seconds:
Router(config)# flow exporter FLOW-EXPORTER-1
Router(config-flow-exporter)# template data timeout 1000
Related Commands
|
|
|
|---|---|
flow exporter |
Creates a flow exporter. |
transport (Flexible NetFlow)
To configure the transport protocol for a Flexible NetFlow flow exporter, use the transport command in Flexible NetFlow flow exporter configuration mode. To remove the transport protocol for a Flexible NetFlow flow exporter, use the no form of this command.
transport udp udp-port
no transport
Syntax Description
udp udp-port |
Specifies User Datagram Protocol (UDP) as the transport protocol and the UDP port number. |
Command Default
Flow exporters use UDP on port 9995.
Command Modes
Flexible NetFlow flow exporter configuration (config-flow-exporter)
Command History
Examples
The following example configures UDP as the transport protocol and a UDP port number of 250:
Router(config)# flow exporter FLOW-EXPORTER-1
Router(config-flow-exporter)# transport udp 250
Related Commands
|
|
|
|---|---|
flow exporter |
Creates a flow exporter. |
ttl (Flexible NetFlow)
To configure the time-to-live (TTL) value for a Flexible NetFlow flow exporter, use the ttl command in Flexible NetFlow flow exporter configuration mode. To remove the TTL value for a Flexible NetFlow flow exporter, use the no form of this command.
ttl ttl
no ttl
Syntax Description
ttl |
Configures the time-to-live (TTL) value for exported datagrams. Range: 1 to 255. Default 255. |
Command Default
Flow exporters use a TTL of 255.
Command Modes
Flexible NetFlow flow exporter configuration (config-flow-exporter)
Command History
Examples
The following example specifies a TTL of 15:
Router(config)# flow exporter FLOW-EXPORTER-1
Router(config-flow-exporter)# ttl 15
Related Commands
|
|
|
|---|---|
flow exporter |
Creates a flow exporter. |
Feedback