Need info on a command

[Raja_D]

Hi, 

can someone brief as of how to analyze the forward and reverse response from the "show ip cache flow" output. 

example:

int fa0/0     ------------------- lan interface

ip add 192.168.1.1 255.255.255.0

ip route-cache flow

Thanks, 

James.. 

[Reza Sharifi]

Hi,

Have a look at this link for explanation of the output.

https://ccie-or-null.net/2011/01/13/whos-congesting-my-network/

HTH

[Raja_D]

Hi Reza, 

Thanks for the info. From the "show ip cache flow" output I could notice that the source interface, ip address, destination interface and destination ip address details are visible along with the bytes consumed. It makes me understand that its of Forward direction from Lan to outside, do we get the reverse acknowledgement also visible in this output along with the bytes consumed ??

I am just trying to know this to confirm if we have the reverse response or not for the traffic that is originated from destination server back to the PC in lan.

Please confirm. 

James.. 

[Jon Marshall]

James

My understanding is that it is ingress only and if you wanted to see the return traffic you would need to apply the same command to the interface where the return traffic enters the router.

Jon

[Raja_D]

Jon, 

Small clarification with your below statement :

"My understanding is that it is ingress only and if you wanted to see the return traffic you would need to apply the same command to the interface where the return traffic enters the router."

Do you mean that we will need to enable "ip route-cache flow" over the wan interface for viewing the return traffic from lan towards destination ??

James.. 

[Jon Marshall]

James

You have enabled it already on the LAN interface which means you see traffic coming from LAN clients to the router.

If you want to see the return traffic to the clients on the LAN then you would enable it on the interface where the return traffic enters the router.

If that is the WAN interface then yes you need to enable it there to see the flow in both directions.

Jon

[Raja_D]

Thank you Jon for all your explanation. !!!

[Joseph W. Doherty · Accepted solution]

If I remember correctly, route-cache flow only capture stats for ingress traffic.

If you want to capture a port's egress flow stats, you need to capture the ingress stats from all the other interfaces that might have traffic that will egress the port in question.