How do you configure NetFlow Top Talkers on ASR1002

[John Collins]

Hello all,

I am trying to configure the NetFlow Top Talkers function on an ASR1002 with ADVENTERPRISEK9-M, Version 15.2(4)S.  With this new Hardware and Software I am surprised to see that the command:

ip flow-top-talkers

  top 50

  sort-by packets

cannot be found on the CLI - it's just not there.   What could the reason be for this? 

Many thanks in advance for any suggestions

John

[Ivan Shirshin]

Hi John,

Netflow top talkers feature is not supported yet on ASR1k.

Kind Regards,
Ivan Shirshin

**Please grade this post if you find it useful.

[kstolle]

The old top talker function is replaced by flexible netflow commands.   For example

In global config mode, create a flexible flow monitor

flow monitor NETFLOW-1

description monitor for ipv4 flows

record netflow ipv4 original-input

Assign the flow monitor to the interface

interface GigabitEthernet0/0/0

  ip address 10.x.x.x 255.255.255.252

  ip flow monitor NETFLOW-1 input

end

Exec mode CLI command below will provide similar output to the old top talkers

show flow monitor NETFLOW-1 cache format table

[Tah00ra001]

hi,

The problem is the output of "show flow monitor NETFLOW-1 cache format table" doesnt have any order ,seems doesnt show most top talkers like old platforms...

how can I sort em to show me who is most BW consuming ?in case of seeking attackers

[prasadv23]

i Guess this might work :)

show flow monitor NETFLOW-1 cache sort highest counter packets top 30 format table

[mrianoro]

Hello, greetings.

That command worked!.

Thanks.

[Beau Clark]

Thank you for the information, but is there any way to get it to output the data in bytes instead of number of packets? The problem we are trying to isolate in the top talkers is users who are doing large FTP or HTTP downloads, they have very large packet sizes but a lower number of packets than other more chatty communication.