top talkers

[ziamcaccna]

Hi,

I have Cisco ISR4431 router. it has isr4400-universalk9.03.16.02.S.155-3.S2-ext.SPA.bin image. want to configure the top talkers. but it is not talking ip flow commend.

Please help me in configuring the top talkers?

Thanks

Zia

[Marvin Rhoads]

ziamcaccna  ,

Are you following the syntax for Flexible Netflow as described in the configuration guide below?

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/xe-3s/fnf-xe-3s-book/fnf-ipv4-uni.html

If so, "ip flow monitor monitor-name {input | output}" should be an option under the interface configuration mode.

[ziamcaccna]

Thank you. yes I tried that but in that case the show output of the monitor is so big and not easily readable. is there any way to get the output like we get in show ip flow top-talkers while using the flexible net flow.

T

[Marvin Rhoads]

The primary method for displaying and parsing the Netflow data is to use your Netflow analysis tool. Something like the Plixer Scrutinizer or SolarWinds NTA tool.

[ziamcaccna]

Hi,

posting it just if it helps someone.

My problems were-

get top talkers

after flexible netflow it was showing a very long table

I was not able to sort the output

--------------------------------------

I had isr4400-universalk9.03.13.04.S.154-3.S4-ext.SPA.bin IOS. so after configuring Flexible Netflow it was showing a very huge data and I was not able to sort it. on of my friend asked me to to upgrade the ios to isr4400-universalk9.03.16.02.S.155-3.S2-ext.SPA.bin to get the sorting feature.

After upgrading the ios I am able to use sorting and with some configuring even output is good

this is configuration now

flow record BW
 description top_talkers
 match ipv4 source address
 match ipv4 destination address
 collect interface input
 collect interface output
 collect counter bytes long
 collect counter packets long
flow monitor mpls
 description to monitor normal traffic
 record netflow-original
flow monitor BW
 description description top_talkers
 record BW

int gi 0/0/0

.

..

 ip flow monitor mpls input
 ip flow monitor BW input
 ip flow monitor mpls output
 ip flow monitor BW output

.

.

.

this is the output now....

#sh flow monitor BW cache sort counter bytes long format table
Processed 3574 flows
Aggregated to 20 flows
Showing the top 20 flows

IPV4 SRC ADDR    IPV4 DST ADDR    intf input            intf output                     bytes long             pkts long
===============  ===============  ====================  ====================  ====================  ====================