Flow monitor commands - How can I understand the command result?

[eeebbunee]

Hello Professionals,

I set up 'Flow monitor' to my switch followed document and it seems working great.

However, whenever I tried to see flow cache, I'm confused the order of commands and result.

For example)

a) show flow monitor MPLS_OUT cache aggr ipv4 dest add ipv4 source add sort highest counter bytes long top 5
b) show flow monitor MPLS_OUT cache aggr counter bytes long ipv4 dest add ipv4 source add sort highest counter bytes  long top 5

How can I understand two different commands and result? How different a) and b)?

What I want to get from the switch is top 5 IP addresses currently using most of bandwidth.

Which command gives more correct information to me?

I appreciate your comments.

[M02@rt37 · Accepted solution]

Hello @eeebbunee,

For your specific goal of finding the top 5 IP addresses currently using the most bandwidth, you should use command (a) because it first aggregates the flows and then sorts by the highest counter (byte count) to give you the correct information.

So, the command a) is more appropriate for your use case.

In command (a), "counter bytes long" is placed before specifying the IPv4 destination and source addresses. This command first aggregates the flows, then specifies the IPv4 destination and source addresses, sorts by the highest counter (which is typically the byte count), and finally, shows the top 5 results.

In command (b), "counter bytes long" is placed after specifying the IPv4 destination and source addresses. This command first specifies the IPv4 destination and source addresses, then aggregates the flows, and finally, sorts by the highest counter and shows the top 5 results.