How To Get MAC and IP Address Accounting Information Using SNMP

Introduction

This document gives examples on how to obtain MAC and IP address accounting information from Cisco routers using Simple Network Management Protocol (SNMP).

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

This document is not restricted to specific software and hardware versions.

Conventions

For more information on document conventions, refer to the Cisco Technical Tips Conventions.

MAC Address Accounting

The MAC address accounting feature provides accounting information for IP traffic based on the source and destination MAC addresses on LAN interfaces. This feature calculates the total packet and byte counts for a LAN interface that receives or sends IP packets to or from a unique MAC address. It also records a timestamp for the last packet received or sent.

From a command line, you get this result:

router_10.64.7.2#show running
<snip>
...
interface FastEthernet2/0
ip address 10.64.7.2 255.255.255.248
ip accounting mac-address input
ip accounting Mac-address output
...
 <snip>
...
snmp-server community public RO
SNMP-server community private RW
...
<snip>
 

router_10.64.7.2#show interfaces mac

FastEthernet2/0 

  Input  (486 free)

    0000.0c75.4120(24 ):  19349 packets, 1608842 bytes, last: 5360ms ago

    00e0.1e3f.6989(33 ):  19272 packets, 1597208 bytes, last: 1276ms ago

    ... 

    0040.0550.bc5c(245):  207 packets, 44890 bytes, last: 174440ms ago

                   Total:  1091720 packets, 178475402 bytes

  Output  (506 free)

    0040.ca19.c776(34 ):  3744 packets, 400075 bytes, last: 81804ms ago

    ... 

    0090.bf1f.e000(208):  229537 packets, 64266576 bytes, last: 0ms ago

                   Total:  266111 packets, 70376527 bytes

 router_10.64.7.2#

Alternatively, it is possible to obtain the above information using SNMP from CISCO-IP-STAT-MIB as shown:

% snmpwalk 10.64.7.2 public .1.3.6.1.4.1.9.9.84.1.2.1
enterprises.9.9.84.1.2.1.1.3.9.1.0.0.12.117.65.32 = Counter32: 19349
...
enterprises.9.9.84.1.2.1.1.3.9.2.1.0.94.0.0.5 = Counter32: 19040
enterprises.9.9.84.1.2.1.1.4.9.1.0.0.12.117.65.32 = Counter32: 1608842
...
enterprises.9.9.84.1.2.1.1.4.9.2.1.0.94.0.0.5 = Counter32: 1485120 

Notes:

public = RO community string 
1.3.6.1.4.1.9.9.84.1.2.1 = cipMacTable 
1.3.6.1.4.1.9.9.84.1.2.1.1.3 = cipMacSwitchedPkts 
1.3.6.1.4.1.9.9.84.1.2.1.1.4 = cipMacSwitchedBytes

Take one of the examples from the snmpwalk command output.

• For the first half of the output, that is, cipMacSwitchedPkts:

  enterprises.9.9.84.1.2.1.1.3.9.1.0.0.12.117.65.32 = Counter32: 19349

  Here, the 9 is the ifIndex, and the 1 is cipMacDirection.

  input(1), 
  output(2) 

  So, 0.0.12.117.65.32 is the MAC address, that is, 0000.0c75.4120. The MAC address is in decimal: 0.0.12.117.65.32 (which translates to 0000.0c75.4120 in hexadecimal).

  The number of packets = 19349.

• For the second half of the SNMP output, that is, cipMacSwitchedBytes:

  enterprises.9.9.84.1.2.1.1.4.9.1.0.0.12.117.65.32 = Counter32: 1608842

  Here, the 9 is the ifIndex and the 1 is cipMacDirection.

  input(1),
  output(2) 

  So, 0.0.12.117.65.32 is the MAC address, that is, 0000.0c75.4120.

  The number of bytes = 1608842. This corresponds to the following entry in the show interfaces mac command output:

  router_10.64.7.2#show interfaces mac
  FastEthernet2/0 
    Input  (486 free)
      0000.0c75.4120(24 ):  19349 packets, 1608842 bytes, last: 5360ms ago
  ...
  

CISCO-IP-STAT-MIB is supported on Cisco routers since Cisco IOS® Software Release 12.0. For more information on MIB support, refer to the MIB Locator (registered customers only) .

Further information is available at:

• MAC Address Accounting and Precedence Accounting.

• SNMP Object Navigator

IP Address Accounting

By enabling IP accounting, users can see the number of bytes and packets switched through the Cisco IOS Software on a source and destination IP address basis. Only transit IP traffic is measured and only on an outbound basis; traffic generated by the software or terminating in the software is not included in the accounting statistics.

To maintain accurate accounting totals, the software maintains two accounting databases: an active and a checkpointed database. There are two tables in OLD-CISCO-IP-MIB.my, which are lipCkAccountingTable (the checkpoint database) and lipAccountingTable (the active database). The actCheckPoint copies the active database into the checkpoint database. Consequently, the show ip accounting command is cleared.

A network management system (NMS) can use lipCkAccountingTable from the MIB to analyze stable data in the checkpoint database. The running, or active, database is copied into the checkpoint database. If the checkpoint database already has data obtained previously from the active database, the router appends the latest copy of the active database to the existing data in the checkpoint database. The checkpoint database stores data retrieved from the active database until actCheckPoint is set, or until you delete the contents of this database by issuing the clear ip accounting [checkpoint] command.

The MIB actCheckPoint activates a checkpoint database. This variable must be read and then set to the same value that was read. The value that is read and then set is incremented after a successful set request. The configuration on the router is as follows:

<snip>
...
interface FastEthernet2/0
ip address 10.64.7.2 255.255.255.248
ip accounting output-packets
...
<snip>

How To Get IP Address Accounting Information Using SNMP

Use checkpointing and retrieve the data from the checkpoint database using SNMP to get accurate accounting data.

A two-step process is needed to set up the checkpoint and to copy the data from the active database to the checkpoint database:

1. Read the value of actCheckPoint (1.3.6.1.4.1.9.2.4.11).

   % snmpget -v 1 10.64.7.2 public .1.3.6.1.4.1.9.2.4.11.0
        enterprises.9.2.4.11.0 = 0
   

2. Set the actCheckPoint to the value that was just read.

   % snmpset 10.64.7.2 private .1.3.6.1.4.1.9.2.4.11.0 i 0
        enterprises.9.2.4.11.0 = 0
   

   Note:  If the set is successful the value of actCheckPoint increments by one.

   % snmpget -v 1 10.64.7.2 public .1.3.6.1.4.1.9.2.4.11.0
   enterprises.9.2.4.11.0 = 1
   

Here, you do not really delete the IP checkpoint accounting table. When you checkpoint the table, you copy the live table to the checkpoint table, and reinitialize the live table. Checkpointing as above deletes or reinitializes the IP accounting table. To retrieve the IP checkpoint accounting table, snmpwalk the lipCkAccountingTable.

Note: 1.3.6.1.4.1.9.2.4.9 = lipCkAccountingTable:

% snmpwalk 10.64.7.2 public .1.3.6.1.4.1.9.2.4.9
enterprises.9.2.4.9.1.1.10.64.7.26.172.17.111.59 = IpAddress: 10.64.7.26
enterprises.9.2.4.9.1.1.172.17.110.208.172.17.110.223 = IpAddress: 172.17.110.208
enterprises.9.2.4.9.1.2.10.64.7.26.172.17.111.59 = IpAddress: 172.17.111.59
enterprises.9.2.4.9.1.2.172.17.110.208.172.17.110.223 = IpAddress: 172.17.110.223
enterprises.9.2.4.9.1.3.10.64.7.26.172.17.111.59 = 29
enterprises.9.2.4.9.1.3.172.17.110.208.172.17.110.223 = 57
enterprises.9.2.4.9.1.4.10.64.7.26.172.17.111.59 = 2436
enterprises.9.2.4.9.1.4.172.17.110.208.172.17.110.223 = 5700
enterprises.9.2.4.9.1.5.10.64.7.26.172.17.111.59 = 0
enterprises.9.2.4.9.1.5.172.17.110.208.172.17.110.223 = 0

From the router_10.64.7.2:

router_10.64.7.2#show ip account
    Source         Destination              Packets               Bytes
172.17.110.208  172.17.110.223                   25                2500
10.64.7.26       172.17.111.59                   13                1092

The accounting data age is 0.

In summary, setting the actCheckPoint erases data in the lipCkAccountingTable. In other words, this starts with a brand new database.

OLD-CISCO-IP-MIB is supported on Cisco routers since Cisco IOS Software Release 10.x. For more information on MIB suppport, refer to the MIB Locator (registered customers only) .

Further information is available at:

• Configuring IP Services

• SNMP Object Navigator

Related Information

• Simple Network Management Protocol Support Resources
• Technical Support - Cisco Systems