05-13-2008 06:48 PM - edited 03-03-2019 09:56 PM
Hi,
My question is with regards to the usage of the ip accouting command. The Cisco doc says that 'Only transit IP traffic is measured and only on an outbound basis ' ....
[1] When I do the below command, it looks like the 'rx' is high but if I do enable 'ip accounting' on the interface, would it display any output since rx is inbound traffic ?
-----------------------------------------
sh int s0/0/0:1
Serial0/0/0:1 is up, line protocol is up
Hardware is GT96K Serial
Description: 256k data circuit id DZEC939078
MTU 1500 bytes, BW 256 Kbit, DLY 20000 usec, reliability 255/255, txload 7/255, ** rxload 245/255 **
-----------------------------------------
[2] Also the interface s0/0/0:1 is the main interface and it has 2 sub point-to-point interfaces.
Therefore the ip accounting should be applied to one of the sub-interfaces right ? This is because when
I apply on the s0/0/0:1 interface, I do not see any display when I do a 'sh ip accounting' command ?
This is a 2800 router with IOS version 12.4(1a).
Pls advice,
Cheers,
- sn -
05-14-2008 12:03 PM
I wouldn't expect it to show any output since the traffic is inbound. If you are trying to figure out what that traffic is, I suggest using netflow ("ip route-cache flow" on the interface). "show ip cache flow" will print out the flows on that interface. I don't know off the top of my head whether you need to configure on main or sub interface, but you can try it both ways. IP accounting is an old feature and netflow is the way to get this data going forward.
05-15-2008 02:16 PM
Hi ,
i have amlost same case where ATM interface
has high RX traffic load.
we have enabled ip accounting on
this interface interface ATM0/0/0.777 point-to-point
interface ATM0/0/0.777 point-to-point
description -att-MPLS-E1-2M-1.6M-ePVC.777
bandwidth 1600
ip address 10.254.4.121 255.255.255.252
ip accounting output-packets
ip flow ingress
ip flow egress
no snmp trap link-status
when i do sh ip accoutning it shows
Source Destination Packets Bytes
10.15.226.233 10.12.29.21 59584 3168096
10.15.226.213 75.139.128.115 93295 4851340
10.15.227.48 10.12.29.206 870 83196
10.15.227.49 10.12.29.200 735 70506
10.15.226.21 10.24.64.165 19 1596
10.15.227.253 10.4.28.12 771 78677
10.15.227.238 10.50.17.36 7113 175223
so in this case i need to use netflow?
if yes how can i enable netflow on this router?
05-15-2008 04:23 PM
If you're worried about RX, then the ip accounting won't help you. You actually already have netflow enabled on that interface ("ip flow ingress"). This is the alternative configuration to "ip route-cache flow" that I mentioned in the previous post.
So, since you already have netflow configured, just run "show ip cache flow" and look for flows on the ATM interface.
FYI
"ip flow ingress" will monitor just inbound traffic on that interface. "ip flow egress" will monitor outbound.
05-15-2008 06:39 PM
hi than ks for reply
so enable netflow on any router inetrface
we can use the ip flow ingress command?
i ran the sh ip cache flow command it is lot
of output any way to understand the output?
any cisco article?
sh ip cache flow
IP packet size distribution (837497005 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.000 .521 .047 .037 .023 .018 .007 .006 .004 .005 .010 .002 .002 .002 .001
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.001 .002 .002 .016 .284 .000 .000 .000 .000 .000 .000
IP Flow Switching Cache, 278544 bytes
255 active, 3841 inactive, 67367017 added
1317107195 ager polls, 0 flow alloc failures
Active flows timeout in 30 minutes
Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 21640 bytes
255 active, 769 inactive, 67367017 added, 67367017 added to flow
0 alloc failures, 360 force free
1 chunk, 134 chunks added
last clearing of statistics never
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow
TCP-Telnet 616 0.0 11 47 0.0 5.2 9.1
TCP-FTP 706 0.0 5 66 0.0 3.8 10.5
TCP-FTPD 560 0.0 2 53 0.0 1.2 9.1
TCP-WWW 10550204 3.9 18 729 70.4 6.1 5.9
TCP-SMTP 2962 0.0 1 59 0.0 0.4 13.2
TCP-NNTP 431 0.0 2 44 0.0 1.5 7.7
TCP-Frag 527 0.0 2 659 0.0 2.5 15.5
TCP-other 46926523 17.3 12 417 223.6 7.0 12.5
UDP-DNS 1107752 0.4 1 70 0.6 2.5 15.4
UDP-NTP 132470 0.0 1 76 0.0 0.0 15.5
UDP-TFTP 378 0.0 5 52 0.0 7.9 15.5
UDP-Frag 852 0.0 2 469 0.0 3.2 15.4
UDP-other 6770550 2.5 3 193 9.1 4.7 15.4
ICMP 1867182 0.6 2 98 1.9 5.7 15.4
IP-other 5233 0.0 2031 472 3.9 316.3 13.8
Total: 67366946 24.9 12 479 309.9 6.5 11.9
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
AT0/0/0.777 10.7.49.15 Fa0/0 10.15.226.4 06 1E78 A8B1 4
AT0/0/0.777 10.34.4.7 Fa0/0 10.15.226.4 06 1E78 8B09 2
AT0/0/0.777 74.125.45.99 Fa0/0 10.15.226.140 06 0050 04A3 5
AT0/0/0.777 10.25.40.16 Fa0/0 10.15.226.4 06 1E78 8A49 6
Fa0/0 10.15.226.4 AT0/0/0.777* 10.25.240.24 06 AAF8 1E78 34
AT0/0/0.777 10.24.62.55 Fa0/0 10.15.226.4 06 B8AF 1E78 2
Fa0/0 10.15.226.4 AT0/0/0.777* 10.24.62.55 06 1E78 B8AF 2
Fa0/0 10.15.226.4 AT0/0/0.777* 10.3.61.7 06 1E78 5E62 2
AT0/0/0.777 10.54.63.17 Fa0/0 10.15.226.4 06 BADF 1E78 2
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
Fa0/0 10.15.226.4 AT0/0/0.777* 10.50.33.10 06 EBB5 1E78 8407
Fa0/0 10.15.226.108 AT0/0/0.777* 10.253.108.7 11 00A1 0403 1
Fa0/0 10.15.226.4 AT0/0/0.777* 10.25.40.16 06 D341 1E78 2
AT0/0/0.777 10.24.62.55 Fa0/0 10.15.226.4 06 1E78 692D 2
AT0/0/0.777 10.32.62.10 Fa0/0 10.15.226.4 06 1E78 8D01 96
AT0/0/0.777 74.53.127.242 Fa0/0 10.15.226.140 06 0050 04BA 4
Fa0/0 10.15.226.4 AT0/0/0.777* 10.24.62.55 06 692D 1E78 2
AT0/0/0.777 10.5.158.7 Fa0/0
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide