cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
303
Views
0
Helpful
1
Replies

Interface Stats and Cache Flow Stats are different

fred.goetz
Level 1
Level 1

Hello all,

i use a C2611XM in our Backbone. Version: IOS (tm) C2600 Software (C2600-IS-M), Version 12.2(13b).

At the Fa0/1(and only there) we use "ip route-cache flow". In Combination with "ip flow-export" we get an unrealistic sum of bytes passing this Interface at our accounting system. Please see the difference between the stats for "show interface fa0/1" and "show ip cache flow" (Totals Line; Total Flows * Flows/Packet * Bytes/Packet).

Any Help?

2611XM#sh int fa0/1

FastEthernet0/1 is up, line protocol is up

Hardware is AmdFE, address is 000c.3085.8d41 (bia 000c.3085.8d41)

MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 3/255

Encapsulation 802.1Q Virtual LAN, Vlan ID 1., loopback not set

Keepalive set (10 sec)

Full-duplex, 100Mb/s, 100BaseTX/FX

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:08, output 00:00:00, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue: 0/40 (size/max)

5 minute input rate 1519000 bits/sec, 147 packets/sec

5 minute output rate 44000 bits/sec, 97 packets/sec

57254718 packets input, 1178626299 bytes

Received 97654 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog

0 input packets with dribble condition detected

43662515 packets output, 3143989358 bytes, 0 underruns

0 output errors, 0 collisions, 4 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier

0 output buffer failures, 0 output buffers swapped out

2611XM#sh ip cache flow

....

last clearing of statistics never

Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)

-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow

Total: 302092 0.3 189 1129 60.6 13.0 7.3

1 Reply 1

gmarogi
Level 5
Level 5

I think Netflow only supports IP traffic and it can capture only flows that are switched through the router, but not router generated traffic or other layer2 traffic like CDP, VTP or DTP messages that are exchanged. So you won't be able to see the same value between the two commands if you are using any such scenarios.