05-29-2017 08:11 AM - edited 03-05-2019 08:36 AM
Hi,
can someone brief as of how to analyze the forward and reverse response from the "show ip cache flow" output.
example:
int fa0/0 ------------------- lan interface
ip add 192.168.1.1 255.255.255.0
ip route-cache flow
Thanks,
James..
Solved! Go to Solution.
05-30-2017 05:36 AM
If I remember correctly, route-cache flow only capture stats for ingress traffic.
If you want to capture a port's egress flow stats, you need to capture the ingress stats from all the other interfaces that might have traffic that will egress the port in question.
05-29-2017 10:18 AM
Hi,
Have a look at this link for explanation of the output.
https://ccie-or-null.net/2011/01/13/whos-congesting-my-network/
HTH
05-29-2017 11:26 AM
Hi Reza,
Thanks for the info. From the "show ip cache flow" output I could notice that the source interface, ip address, destination interface and destination ip address details are visible along with the bytes consumed. It makes me understand that its of Forward direction from Lan to outside, do we get the reverse acknowledgement also visible in this output along with the bytes consumed ??
I am just trying to know this to confirm if we have the reverse response or not for the traffic that is originated from destination server back to the PC in lan.
Please confirm.
James..
05-30-2017 05:29 AM
James
My understanding is that it is ingress only and if you wanted to see the return traffic you would need to apply the same command to the interface where the return traffic enters the router.
Jon
05-30-2017 08:56 AM
Jon,
Small clarification with your below statement :
"My understanding is that it is ingress only and if you wanted to see the return traffic you would need to apply the same command to the interface where the return traffic enters the router."
Do you mean that we will need to enable "ip route-cache flow" over the wan interface for viewing the return traffic from lan towards destination ??
James..
05-30-2017 09:20 AM
James
You have enabled it already on the LAN interface which means you see traffic coming from LAN clients to the router.
If you want to see the return traffic to the clients on the LAN then you would enable it on the interface where the return traffic enters the router.
If that is the WAN interface then yes you need to enable it there to see the flow in both directions.
Jon
05-30-2017 11:25 AM
Thank you Jon for all your explanation. !!!
05-30-2017 05:36 AM
If I remember correctly, route-cache flow only capture stats for ingress traffic.
If you want to capture a port's egress flow stats, you need to capture the ingress stats from all the other interfaces that might have traffic that will egress the port in question.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide