MPLS Egress NetFlow Accounting

Table Of Contents

MPLS Egress NetFlow Accounting

Contents

Prerequisites for MPLS Egress NetFlow Accounting

Restrictions for MPLS Egress NetFlow Accounting

Information About MPLS Egress NetFlow Accounting

How to Configure MPLS Egress NetFlow Accounting

Enabling MPLS Egress NetFlow Accounting

Configuring NetFlow Aggregation Cache

Examples

Verifying MPLS Egress NetFlow Accounting Configuration

Examples

Troubleshooting Tips

Configuration Examples

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

debug mpls netflow

ip flow egress

show mpls forwarding-table

show mpls interfaces (MPLS Egress NetFlow)

Glossary

MPLS Egress NetFlow Accounting

---

The MPLS egress NetFlow accounting feature allows you to capture Internet Protocol (IP) flow information for packets undergoing multiprotocol label switching (MPLS) label disposition; that is, packets that arrive on a router as MPLS and are transmitted as IP.

One common application of the MPLS egress NetFlow accounting feature allows you to capture the MPLS virtual private network (VPN) IP flows that are traveling from one site of a VPN to another site of the same VPN through the service provider backbone.

Benefits of this feature include the following:

•You can now capture flows on the egress and ingress router interfaces to provide complete end-to-end usage information on network traffic. The accounting server uses the collected data for various levels of aggregation for accounting reports and application programming interface (API) accounting information, thus providing a complete billing solution.

•NetFlow data statistics now account for all the packets that are dropped in the core of the service provider network, thus providing more accurate traffic statistics and patterns.

The MPLS egress NetFlow accounting feature is related to the MPLS VPNs and the NetFlow aggregation features. (See the "Related Documents" section.)

---

Note Before the introduction of this feature, NetFlow referred to the ingress router interface only.

---

History for the MPLS Egress Netflow Accounting Feature

Release	Modification
12.0(10)ST	This feature was introduced.
12.1(5)T	This feature was integrated into Cisco IOS Release 12.1(5)T.
12.0(22)S	This feature was integrated into Cisco IOS Release 12.0(22)S.
12.2(28)SB	This feature was modified to include the Cisco 10000 series routers and integrated into Cisco IOS Release 12.2(28)SB.

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Contents

•Prerequisites for MPLS Egress NetFlow Accounting

•Restrictions for MPLS Egress NetFlow Accounting

•Information About MPLS Egress NetFlow Accounting

•How to Configure MPLS Egress NetFlow Accounting

•Configuration Examples

•Additional References

•Command Reference

•Glossary

Prerequisites for MPLS Egress NetFlow Accounting

The network must support the following Cisco IOS features before you enable the MPLS egress NetFlow accounting feature:

•Multiprotocol label switching (MPLS)

•IP Cisco Express Forwarding (CEF)

Restrictions for MPLS Egress NetFlow Accounting

Capturing Flows from Sites that Connect to the Same PE Router

The captured egress flows must originate from a different site of the same VPN, but they cannot connect to the same provider edge (PE) router. If both source and destination VPN sites are connected to the same PE router, the MPLS egress NetFlow accounting feature does not capture these flows unless the source and destination sites are connected to the PE router by separate physical interfaces. In this case, you can capture these flows by enabling ingress NetFlow on the incoming CE-PE link of the PE router. As shown in Figure 1, traffic from site 3 (VPN1 destined for site 2) is captured by an ingress NetFlow enabled on the PE2-CE3 link of PE2. If the source and destination sites are connected by the same physical interface, this feature will not capture the intended flow statistics.

Memory Impact

During times of heavy traffic, the additional flows can fill up the global flow hash table. If you need to increase the size of the global flow hash table, increase the memory of the router.

Performance Impact

MPLS egress NetFlow accounting might adversely affect network performance because of the additional accounting-related computation that occurs in the traffic-forwarding path of the router.

Information About MPLS Egress NetFlow Accounting

Before this feature was introduced, flows were captured only for IP packets on the ingress interface of a router. You could not capture flows for MPLS encapsulated frames, which were switched through Cisco Express Forwarding (CEF) from the input port. Therefore, in an MPLS VPN environment you captured flow information as packets were received from a customer edge (CE) router and forwarded to the backbone. However, you could not capture flow information as packets were transmitted to a CE router because those packets were received as MPLS frames. The MPLS egress NetFlow accounting feature lets you capture the flows on the outgoing interfaces.

Figure 1 shows a sample topology. To capture the flow of traffic going to site 2 of VPN 1 from any remote VPN 1 sites, you enable MPLS egress NetFlow accounting on link PE2-CE5 of provider edge router PE2. The flows are stored in a global flow cache maintained by the router. You can use the show ip cache flow command or other aggregation flow commands to view the egress flow data.

Figure 1 Provider and Customer Networks with MPLS Egress NetFlow Accounting

The PE routers export the captured flows to the configured collector devices in the provider network. The NetFlow Analyzer or the VPN solution center (VPN-SC) application collects this information and computes and displays site-to-site VPN traffic statistics.

How to Configure MPLS Egress NetFlow Accounting

This section contains the following procedures:

•Enabling MPLS Egress NetFlow Accounting (required)

•Configuring NetFlow Aggregation Cache (optional)

•Verifying MPLS Egress NetFlow Accounting Configuration (optional)

Enabling MPLS Egress NetFlow Accounting

To enable MPLS egress NetFlow accounting, perform the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type

4. ip flow egress

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type Example: Router (config)# interface ethernet	Enters interface configuration mode.
Step 4	ip flow egress Example: Router (config-if)# ip flow egress	Enables MPLS egress NetFlow accounting on the egress router interface.

Configuring NetFlow Aggregation Cache

To configure NetFlow aggregation cache, perform the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. ip flow-aggregation cache {as | as-tos | bgp-nexthop-tos | destination-prefix | destination-prefix-tos | prefix | prefix-port | prefix-tos | protocol-port | protocol-port-tos |source-prefix | source-prefix-tos}

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip flow-aggregation cache {as | as-tos | bgp-nexthop-tos | destination-prefix | destination-prefix-tos | prefix | prefix-port | prefix-tos | protocol-port | protocol-port-tos |source-prefix | source-prefix-tos} Example: Router(config)# ip flow-aggregation cache prefix	Enters aggregation cache configuration mode and specifies the prefix aggregation cache scheme.
Step 4	enable Example: Router(config-flow-cac)# enable	Enables NetFlow aggregation cache. For more information on NetFlow aggregation, see the "Related Documents" section.

Examples

---

Note For more information about the ip flow-aggregation cache command, refer to the NetFlow Aggregation documentation.

---

The following example configures the NetFlow aggregation cache to be prefix-based and enables the cache:

Router(config)# ip flow-aggregation cache

Router(config)# ip flow-aggregation cache ?

  as                  AS aggregation

  destination-prefix  Destination Prefix aggregation

  prefix              Prefix aggregation

  protocol-port       Protocol and port aggregation

  source-prefix       Source Prefix aggregation

Router(config)# ip flow-aggregation cache prefix

Router(config-flow-cac)# enable

Verifying MPLS Egress NetFlow Accounting Configuration

To verify MPLS egress NetFlow accounting configuration, perform the following steps:

SUMMARY STEPS

1. enable

2. show ip cache flow

3. show ip cache[prefix mask] [type number] [verbose] flow aggregation {as | as-tos | bgp-nexthop-tos | destination-prefix | destination-prefix-tos | prefix | prefix-port | prefix-tos | protocol-port | protocol-port-tos | source-prefix | source-prefix-tos}

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	show ip cache flow Example: Router# configure terminal	Displays summary NetFlow switching statistics.
Step 3	show ip cache flow aggregation prefix Example: Router# show ip cache flow aggregation prefix	Displays the contents of the aggregation cache,

Examples

This section provides examples of output from the commands used to verify MPLS egress NetFlow accounting configuration.

Summary Statistics for NetFlow Switching

The following example displays a summary of NetFlow switching statistics.

Router# show ip cache flow

IP packet size distribution (206 total packets):

   1-32   64   96  128  160  192  224  256  288  320  352  384  416 448  480

   .000 .854 .000 .145 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608

   .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 4292920 bytes

  0 active, 62977 inactive, 182 added

  2912 ager polls, 0 flow alloc failures

  Active flows timeout in 30 minutes

  Inactive flows timeout in 15 seconds

  last clearing of statistics never

Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)

--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow /Flow

ICMP               182      0.0         1    62      0.0       0.0 15.5

Total :            182      0.0         1    62      0.0       0.0 15.5

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts

Table 1 describes the fields in the packet size distribution lines of the output.

Table 1 Command Field Descriptions—Packet Size

Field	Description
IP packet size distribution	The two lines below this banner show the percentage distribution of packets by size range.

Table 2 describes the fields in the flow switching cache lines of the output.

Table 2 Command Field Descriptions—Flow Switching Cache

Field	Description
bytes	Number of bytes of memory the NetFlow cache uses.
active	Number of active flows in the NetFlow cache at the time this command is entered.
inactive	Number of flow buffers that are allocated in the NetFlow cache, but are not assigned to a specific flow at the time this command is entered.
added	Number of flows created since the start of the summary period.
ager polls	Number of times the NetFlow code looked at the cache to remove expired entries (used by Cisco for diagnostics only).
flow alloc failures	Number of times the NetFlow code tried to allocate a flow but could not.
last clearing of statistics	Standard time output (hh:mm:ss) since the clear ip flow stats command was executed. This time output changes to hours and days after 24 hours is exceeded.

Table 3 describes the fields in the activity-by-protocol lines of the output.

Table 3 Command Field Descriptions—Activity-by-Protocol

Field	Description
Protocol	IP protocol and the "well known" port number as described in RFC 1340.
Total Flows	Number of flows for this protocol since the last time statistics were cleared.
Flows/Sec	Average number of flows for this protocol seen per second. Equal to total flows/number of seconds for this summary period.
Packets/Flow	Observed average number of packets per flow seen for this protocol. Equal to total packets for this protocol divided by number of flows for this protocol for this summary period.
Bytes/Pkt	Observed average number of bytes per packet seen for this protocol. Equal to the total bytes for this protocol divided by the total number of packets for this protocol for this summary period.
Packets/Sec	Average number of packets per second for this protocol. Equal to the total packets for this protocol divided by the total number of seconds for this summary period.
Active(Sec)/Flow	Sum of all the seconds from the first packet to the last packet of an expired flow (for example, TCP FIN, time-out, and so forth) in seconds per total flows for this protocol for this summary period.
Idle(Sec)/Flow	Sum of all the seconds from the last packet seen in each nonexpired flow for this protocol until the time this command was entered, in seconds per total flows for this protocol for this summary period.

Table 4 describes the fields in the current flow lines of the output.

Table 4 Command Field Descriptions—Current Flow

Field	Description
SrcIf	Router's internal port name for the source interface.
SrcIPaddress	Source IP address for this flow.
DstIf	Router's internal port name for the destination interface.
DstIPaddress	Destination IP address for this flow.
Pr	IP protocol; for example, 6 = TCP, 17 = UDP, ... as defined in RFC 1340.
SrcP	Source port address, TCP/UDP "well known" port number, as defined in RFC 1340.
DstP	Destination port address, TCP/UDP "well known" port number, as defined in RFC 1340.
Pkts	Number of packets that the router observed for this flow.

Aggregation Cache Contents

The following example displays the contents of a prefix-based aggregation cache:

Router# show ip cache flow aggregation prefix

IP Flow Switching Cache, 278544 bytes

  1 active, 4095 inactive, 3 added

  45 ager polls, 0 flow alloc failures

  Active flows timeout in 30 minutes

  Inactive flows timeout in 15 seconds

Src If        Src Prefix     Msk  Dst If        Dst Prefix     Msk Flows  Pkts

Et1/1         34.0.0.0       /8   PO6/0         12.12.12.12    /32 1      5

Router#

Table 5 describes the fields in the flow switching cache lines of the output.

Table 5 Command Field Descriptions—Flow Switching Cache

Field	Description
bytes	Number of bytes of memory the NetFlow cache uses.
active	Number of active flows in the NetFlow cache at the time this command is entered.
inactive	Number of flow buffers that are allocated in the NetFlow cache, but are not assigned to a specific flow at the time this command is entered.
added	Number of flows created since the start of the summary period.
ager polls	Number of times the NetFlow code looked at the cache to remove expired entries (used by Cisco for diagnostics only).
flow alloc failures	Number of times the NetFlow code tried to allocate a flow but could not.

Table 6 describes the fields in the current flow lines of the output.

Table 6 Command Field Descriptions—Current Flow

Field	Description
Src If	Router's internal port name for the source interface.
Src Prefix	Source IP address for this flow.
Msk	Mask source.
Dst If	Router's internal port name for the destination interface.
Dst Prefix	Destination prefix aggregation cache scheme.
Msk	Mask destination.
Flows	Number of flows.
Pkts	Number of packets that the router observed for this flow.

Here is sample output displaying the IP aggregation cache contents:

Router# show ip cache flow

IP packet size distribution (206 total packets):

   1-32   64   96  128  160  192  224  256  288  320  352  384  416 448  480

   .000 .854 .000 .145 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608

   .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 4292920 bytes

  0 active, 62977 inactive, 182 added

  2912 ager polls, 0 flow alloc failures

  Active flows timeout in 30 minutes

  Inactive flows timeout in 15 seconds

  last clearing of statistics never

Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)

--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow /Flow

ICMP               182      0.0         1    62      0.0       0.0 15.5

Total :            182      0.0         1    62      0.0       0.0 15.5

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts

Troubleshooting Tips

Use the following commands for troubleshooting the MPLS egress NetFlow accounting feature:

Command	Purpose
Router# show mpls forwarding-table detail	Shows detailed MPLS forwarding-table entries. The output has been modified to show if MPLS egress NetFlow accounting is applied to packets destined to an entry. This is for debugging purposes only.
Router# show mpls interfaces internal all	Displays detailed information about all of the MPLS interfaces in the router. The output has been modified to show if MPLS egress NetFlow accounting is enabled on the interface. This is for debugging purposes only.

Configuration Examples

This section provides a configuration example for the MPLS egress NetFlow accounting feature.

In the following example, the VPN routing and forwarding (VRF) instances currently configured in the router display:

Router# show ip vrf

  Name                             Default RD          Interfaces

  vpn1                             100:1               Gig2/1/0

                                                       Loopback1

  vpn3                             300:1               Gig2/0/0

                                                       Loopback2

Router#

Router# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Router(config)# interface gig2/1/0

MPLS egress NetFlow accounting is enabled on interface gig2/1/0 and debugging is turned on, as shown below:

Router(config-if)# ip flow egress

Router(config-if)# 

Router(config-if)# 

Router# debug mpls netflow

MPLS Egress NetFlow debugging is on

Router#

The following example shows the current configuration in the router:

Router# show run

Building configuration...

Current configuration:

!

version 12.0

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

ip cef

no ip domain-lookup

!

The VRF is defined, as shown below:

ip vrf vpn1

 rd 100:1

 route-target export 100:1

 route-target import 100:1

!

interface Loopback0

 ip address 41.41.41.41 255.255.255.255

 no ip directed-broadcast

 no ip mroute-cache

!

interface GigabitEthernet2/1/0

 ip vrf forwarding vpn1

 ip address 180.1.1.1 255.255.255.0

 no ip directed-broadcast

 ip flow egress

!

Additional References

The following sections provide references related to the MPLS egress NetFlow accounting feature.

Related Documents

Related Topic	Document Title
Guidelines for configuring switching paths and routing between virtual local-area networks (VLANs)	Cisco IOS Switching Services Configuration Guide
Switching commands: complete command syntax, command mode, command history, defaults, usage guidelines, and examples	Cisco IOS Switching Services Command Reference
Description of the NetFlow aggregation feature and how to configure the feature	NetFlow Aggregation

Standards

Standard	Title
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.	—

MIBs

MIB	MIBs Link
No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.	To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs

RFCs

RFC	Title
RFC 1163	A Border Gateway Protocol (BGP)
RFC 1340	Assigned Numbers
RFC 1918	Address Allocation for Private Internets
RFC 2547	BGP/MPLS VPNs

Technical Assistance

Description	Link
The Cisco Technical Support website contains thousands of pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.	http://www.cisco.com/techsupport

Command Reference

This section describes new and modified commands only.

•debug mpls netflow

•ip flow egress

•show mpls forwarding-table

•show mpls interfaces (MPLS Egress NetFlow)

debug mpls netflow

To display debug messages for MPLS egress NetFlow accounting, use the debug mpls netflow command. To disable debugging output, use the no form of this command.

debug mpls netflow

no debug mpls netflow

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default behavior or values.

Command Modes

EXEC

Command History

Release	Modification
12.0(10)ST	This command was introduced.
12.1(5)T	This command was integrated into Cisco IOS Release 12.1(5)T.
12.0(22)S	This command was integrated into Cisco IOS Release 12.0(22)S.
12.2(28)SB	This command was integrated into Cisco IOS Release 12.2(28)SB.

Examples

Here is sample output from the debug mpls netflow command:

Router#

Router# debug mpls ?

  adjacency    MPLS adjacency database events

  atm-cos      MPLS Controlled ATM CoS

  atm-ldp      MPLS ATM LDP

  events       MPLS events

  ldp          Label Distribution Protocol

  lfib         MPLS Forwarding Information Base services

  netflow      MPLS Egress NetFlow Accounting

  packets      MPLS packets

  tagcon       MPLS/Tag control process

  traffic-eng  MPLS Traffic Engineering debug

Router# debug mpls netflow

MPLS Egress NetFlow debugging is on

Router#

Router#

Router#

4d00h:Egress flow:entry created, dest 3.3.3.3/32, src 34.0.0.1/8

Router#

Router#

4d00h:Egress flow:entry created, dest 3.3.3.3/32, src 42.42.42.42/32

Router# conf t

Enter configuration commands, one per line.  End with CNTL/Z.

Router(config)# int eth1/4

Router(config-if)# no mpls netflow egress

Router(config-if)#

4d00h:MPLS output feature change, trigger TFIB scan

4d00h:tfib_scanner_walk, prefix 5.5.5.5/32, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 2.0.0.0/8, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 3.3.3.3/32, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 40.40.40.40/32, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 50.50.50.50/32, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 100.100.100.100/32, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 180.1.1.0/24, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 190.1.1.0/24, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 2.0.0.0/8, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 4.4.4.4/32, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 40.40.40.40/32, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 50.50.50.50/32, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 177.1.1.0/24, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 180.1.1.0/24, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 190.1.1.0/24, rewrite flow flag 1

Router(config-if)#

Router(config-if)# mpls netflow egress

Router(config-if)#

4d00h:Interface refcount with output feature enabled = 2

4d00h:MPLS output feature change, trigger TFIB scan

4d00h:tfib_scanner_walk, prefix 5.5.5.5/32, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 2.0.0.0/8, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 3.3.3.3/32, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 40.40.40.40/32, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 50.50.50.50/32, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 100.100.100.100/32, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 180.1.1.0/24, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 190.1.1.0/24, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 2.0.0.0/8, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 4.4.4.4/32, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 40.40.40.40/32, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 50.50.50.50/32, rewrite flow flag 0

4d00h:tfib_scanner_walk, prefix 177.1.1.0/24, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 180.1.1.0/24, rewrite flow flag 1

4d00h:tfib_scanner_walk, prefix 190.1.1.0/24, rewrite flow flag 1

4d00h:Egress flow:entry created, dest 3.3.3.3/32, src 42.42.42.42/32

Router(config-if)#

Router(config-if)# end

Router# show run int eth1/4

Building configuration...

Current configuration:

!

interface Ethernet1/4

 ip vrf forwarding vpn1

 ip address 180.1.1.1 255.255.255.0

 no ip directed-broadcast

 mpls netflow egress

end

Router#

Router#

Router#

4d00h:%SYS-5-CONFIG_I:Configured from console by console

Router#

---

Note Flow flag 1 prefixes are reachable through this interface; therefore, MPLS egress NetFlow accounting is applied to all packets going out the destination prefix. Flow flag 0 prefixes are not reachable through this interface; therefore, MPLS egress NetFlow accounting is not applied to any packets going out the destination prefix.

---

Related Commands

Command	Description
show debug	Displays active debug output.

ip flow egress

To enable egress NetFlow accounting for traffic that the router is forwarding, use the ip flow egress command in interface or subinterface configuration mode. To disable egress NetFlow accounting for traffic that the router is forwarding, use the no form of this command.

ip flow egress

no ip flow egress

Syntax Description

This command has no arguments or keywords.

Defaults

This command is disabled by default.

Command Modes

Interface configuration
Subinterface configuration

Command History

Release	Modification
12.3(11)T	This command was introduced.
12.2(28)SB	This command was integrated into Cisco IOS Release 12.2(28)SB.

Usage Guidelines

You must enable either Cisco Express Forwarding (CEF) or distributed CEF (dCEF) before using this command.

Use this command on an interface or subinterface to enable NetFlow accounting for traffic that is being forwarded by the router.

Examples

The following example shows how to configure egress NetFlow accounting with CEF switching on Ethernet interface 0/0:

Router(config)# ip cef

Router(config)# interface Ethernet0/0

Router(config-if)# ip route-cache cef

Router(config-if)# ip flow egress

The following example shows how to configure egress NetFlow accounting with dCEF on Ethernet interface 0/0:

Router(config)# ip cef distributed

Router(config)# interface Ethernet0/0

Router(config-if)# ip route-cache cef

Router(config-if)# ip flow egress

Related Commands

Command	Description
ip flow ingress	Enables NetFlow (ingress) accounting for traffic arriving on an interface.
ip flow-egress input-interface	Removes the NetFlow egress accounting flow key that specifies an output interface and adds a flow key that specifies an input interface for NetFlow egress accounting.
ip flow-cache timeout	Specifies NetFlow accounting flow cache parameters.
ip flow-cache entries	Changes the number of entries maintained in the NetFlow accounting cache.
show ip cache flow	Displays a summary of the NetFlow accounting statistics.
show ip cache verbose flow	Displays a detailed summary of the NetFlow accounting statistics.
show ip flow interface	Displays NetFlow accounting configuration on interfaces.

show mpls forwarding-table

To display the contents of the Multiprotocol Label Switching (MPLS) label forwarding information base (LFIB), use the show mpls forwarding-table command in privileged EXEC mode.

show mpls forwarding-table [network {mask | length} | labels label [- label] | interface interface | next-hop address | lsp-tunnel [tunnel-id]] [vrf vrf-name] [detail]

Syntax Description

network	(Optional) Destination network number.
mask	(Optional) IP address of the destination mask whose entry is to be shown.
length	(Optional) Number of bits in mask of destination.
labels label - label	(Optional) Displays only entries with the specified local labels.
interface interface	(Optional) Displays only entries with the specified outgoing interface.
next-hop address	(Optional) Displays only entries with the specified neighbor as the next hop.
lsp-tunnel	(Optional) Displays only entries with the specified label switched path (LSP) tunnel, or with all LSP tunnel entries.
tunnel-id	(Optional) Specifies the LSP tunnel for which to display entries.
vrf vrf-name	(Optional) Displays only entries with the specified VPN routing/forwarding instance (VRF).
detail	(Optional) Displays information in long form (includes length of encapsulation, length of MAC string, maximum transmission unit (MTU), and all labels).

Command Modes

Privileged EXEC

Command History

Release	Modification
11.1 CT	This command was introduced.
12.1(3)T	This command was modified to reflect new MPLS Internet Engineering Task Force (IETF) terminology and command-line interface (CLI) command syntax.
12.2(8)T	The command was modified to accommodate use of the MPLS experimental (EXP) level as a selection criteria for packet forwarding. The output display was modified to include a bundle adjacency field and exp (vcd) values when the optional detail keyword is specified.
12.0(22)S	IPv6 MPLS aggregate label and prefix information was added to the display.
12.2(14)S	This command was integrated into Cisco IOS Release 12.2(14)S.
12.0(29)S	This command was integrated into Cisco IOS Release 12.0(29)S.
12.2(27)SBC	This command was integrated into Cisco IOS Release 12.2(27)SBC.
12.2(28)SB	This command was integrated into Cisco IOS Release 12.2(28)SB.

Usage Guidelines

The options described allow specification of a subset of the entire LFIB.

Examples

The following is sample output from the show mpls forwarding-table command:

Router# show mpls forwarding-table

Local Outgoing      Prefix            Bytes tag Outgoing       Next Hop       

tag   tag or VC     or Tunnel Id      switched  interface                     

26    Untagged      10.253.0.0/16     0         Et4/0/0       172.27.32.4    

28    1/33          10.15.0.0/16      0         AT0/0.1       point2point    

29    Pop tag       10.91.0.0/16      0         Hs5/0         point2point    

      1/36          10.91.0.0/16      0         AT0/0.1       point2point    

30    32            10.250.0.97/32    0         Et4/0/2       10.92.0.7      

      32            10.250.0.97/32    0         Hs5/0         point2point    

34    26            10.77.0.0/24      0         Et4/0/2       10.92.0.7      

      26            10.77.0.0/24      0         Hs5/0         point2point    

35    Untagged  [T] 10.100.100.101/32 0         Tu301         point2point    

36    Pop tag       168.1.0.0/16      0         Hs5/0         point2point    

      1/37          168.1.0.0/16      0         AT0/0.1       point2point    

[T]     Forwarding through a TSP tunnel.

        View additional tagging info with the 'detail' option

The following is sample output from the show mpls forwarding-table command when the IPv6 Provider Edge Router over MPLS feature is configured to allow IPv6 traffic to be transported across an IPv4 MPLS backbone. The labels are aggregate because there are several prefixes for one local label, and the prefix column contains "IPv6" instead of a target prefix.

Router# show mpls forwarding-table

Local Outgoing      Prefix            Bytes tag Outgoing       Next Hop       

tag   tag or VC     or Tunnel Id      switched  interface                     

16    Aggregate     IPv6              0             

17    Aggregate     IPv6              0                 

18    Aggregate     IPv6              0                 

19    Pop tag       192.168.99.64/30  0         Se0/0         point2point    

20    Pop tag       192.168.99.70/32  0         Se0/0         point2point      

21    Pop tag       192.168.99.200/32 0         Se0/0         point2point    

22    Aggregate     IPv6              5424    

23    Aggregate     IPv6              3576 

24    Aggregate     IPv6              2600

The following is sample output from the show mpls forwarding-table command when you specify the detail keyword. If the MPLS EXP level is used as a selection criterion for packet forwarding, a bundle adjacency exp (vcd) field is included in the display. This field includes the EXP value and the corresponding virtual circuit descriptor (VCD) in parentheses. The line in the output that reads "No output feature configured" indicates that the MPLS egress NetFlow accounting feature is not enabled on the outgoing interface for this prefix.

Router# show mpls forwarding-table detail

Local Outgoing      Prefix            Bytes tag Outgoing       Next Hop       

tag   tag or VC     or Tunnel Id      switched  interface                     

16    Pop tag       1.0.0.6/32        0         AT1/0.1       point2point 

  Bundle adjacency exp(vcd)

  0(1) 1(1) 2(1) 3(1) 4(1) 5(1) 6(1) 7(1)

  MAC/Encaps=12/12, MTU=4474, Tag Stack{}

      00010000AAAA030000008847

  No output feature configured

17    18            1.0.0.9/32        0         AT1/0.1       point2point    

  Bundle adjacency exp(vcd)

  0(1) 1(1) 2(1) 3(1) 4(1) 5(1) 6(1) 7(1)

  MAC/Encaps=12/16, MTU=4470, Tag Stack{18}

      00010000AAAA030000008847 00012000

  No output feature configured

18    19            1.0.0.10/32        0        AT1/0.1       point2point    

  Bundle adjacency exp(vcd)

  0(1) 1(1) 2(1) 3(1) 4(1) 5(1) 6(1) 7(1)

  MAC/Encaps=12/16, MTU=4470, Tag Stack{19}

      00010000AAAA030000008847 00013000

  No output feature configured

19    17            20.0.0.0/8         0        AT1/0.1       point2point    

  Bundle adjacency exp(vcd)

  0(1) 1(1) 2(1) 3(1) 4(1) 5(1) 6(1) 7(1)

  MAC/Encaps=12/16, MTU=4470, Tag Stack{17}

      00010000AAAA030000008847 00011000

  No output feature configured

20    20            60.0.0.0/8         0        AT1/0.1       point2point    

  Bundle adjacency exp(vcd)

  0(1) 1(1) 2(1) 3(1) 4(1) 5(1) 6(1) 7(1)

  MAC/Encaps=12/16, MTU=4470, Tag Stack{20}

      00010000AAAA030000008847 00014000

  No output feature configured

21    Pop tag       60.0.0.0/24        0        AT1/0.1       point2point 

  Bundle adjacency exp(vcd)

  0(1) 1(1) 2(1) 3(1) 4(1) 5(1) 6(1) 7(1)

  MAC/Encaps=12/12, MTU=4474, Tag Stack{}

      00010000AAAA030000008847

  No output feature configured

22    Pop tag       1.0.0.4/32         0        Et2/3         40.0.0.4 

  MAC/Encaps=14/14, MTU=1504, Tag Stack{}

      000427AD10430005DDFE043B8847

  No output feature configured

The following is sample output from the show mpls forwarding-table command when you use the detail keyword. In this example, the MPLS egress NetFlow accounting feature is enabled on the first three prefixes, as indicated by the line in the output that reads "Feature Quick flag set."

Router# show mpls forwarding-table detail

Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop

tag    tag or VC   or Tunnel Id      switched   interface

16     Aggregate   34.0.0.0/8[V]     0

        MAC/Encaps=0/0, MTU=0, Tag Stack{}

        VPN route: vpn1

        Feature Quick flag set

Per-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 

17     Untagged    2.0.0.0/8[V]      0          Et0/0/2    34.0.0.1

        MAC/Encaps=0/0, MTU=1500, Tag Stack{}

        VPN route: vpn1

        Feature Quick flag set

Per-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

18     Untagged    42.42.42.42/32[V] 4185       Et0/0/2    34.0.0.1

        MAC/Encaps=0/0, MTU=1500, Tag Stack{}

        VPN route: vpn1

        Feature Quick flag set

Per-packet load-sharing, slots: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

19     2/33        41.41.41.41/32    0          AT1/0/0.1  point2point

        MAC/Encaps=4/8, MTU=4470, Tag Stack{2/33(vcd=2)}

        00028847 00002000

        No output feature configured

Table 7 describes the significant fields shown in the displays.

Table 7 show mpls forwarding-table Field Descriptions 

Field	Description
Local tag	Label assigned by this router.
Outgoing tag or VC	Label assigned by the next hop or virtual path identifier (VPI)/virtual channel identifier (VCI) used to get to next hop. The entries that you can specify in this column include the following: •[T]—Means forwarding through an LSP tunnel. •"Untagged"—Means that there is no label for the destination from the next hop or that label switching is not enabled on the outgoing interface. •"Pop tag"—Means that the next hop advertised an implicit NULL label for the destination and that this router popped the top label. •"Aggregate"—Means there are several prefixes for one local label. Used when IPv6 is configured on edge routers to transport IPv6 traffic over an IPv4 MPLS network.
Prefix or Tunnel Id	Address or tunnel to which packets with this label are going. Note If IPv6 is configured on edge routers to transport IPv6 traffic over an IPv4 MPLS network, "IPv6" is displayed here.
Bytes tag switched	Number of bytes switched with this incoming label.
Outgoing interface	Interface through which packets with this label are sent.
Next Hop	IP address of the neighbor that assigned the outgoing label.
Bundle adjacency exp (vcd)	Bundle adjacency information. Includes the MPLS EXP value and the corresponding VCD.
MAC/Encaps	Length in bytes of the Layer 2 header and length in bytes of the packet encapsulation, including the Layer 2 header and label header.
MTU	Maximum transmission unit (MTU) of the labeled packet.
Tag Stack	All the outgoing labels. If the outgoing interface is transmission convergence (TC)-ATM, the VCD is also shown.
00010000AAAA030000008847 00013000	The actual encapsulation in hexadecimal form. A space is shown between Layer 2 and the label header.

show mpls interfaces (MPLS Egress NetFlow)

To display the interfaces that have MPLS egress NetFlow accounting enabled, use the show mpls interfaces command in EXEC mode with the internal keyword.

show mpls interfaces [type card/subcard/port | all] [detail] [internal]

Syntax Description

type	(Optional) Specifies one of the interface types listed in Table 8.
card/subcard /port	(Optional) Specifies the card, subcard, and port number of the ATM, ATM-P, CBR, Ethernet, or null interface.
all	(Optional) Displays all of the router's interfaces that have MPLS applications associated with them.
detail	(Optional) Displays detailed label switching information by interface.
internal	(Optional) Displays the value of the output_feature_state. If MPLS egress NetFlow accounting is enabled, output_feature_state is any number except 0. If MPLS egress NetFlow accounting is disabled, output_feature_state is 0.

Defaults

Displays label switching information for all interfaces.

Command Modes

EXEC

Command History

Release	Modification
11.1 CT	This command was introduced.
12.1(3)T	This command was changed from show tag-switching interfaces to show mpls interfaces.
12.0(10)ST	This command was modified to include the value of the output_feature_state.
12.1(5)T	This modified command was integrated into Cisco IOS Release 12.1(5)T.
12.0(22)S	This modified command was integrated into Cisco IOS Release 12.0(22)S.
12.2(28)SB	This command was integrated into Cisco IOS Release 12.2(28)SB.

Usage Guidelines

You can show information about the requested interface or about all interfaces on which MPLS is enabled.

Table 8 describes each of the interface types used with the show mpls interfaces command.

Table 8 Interface Types 

Type	Description
atm	Specifies the ATM interface
atm-p	Specifies the ATM pseudo interface
cbr	Specifies the CBR interface
ethernet	Specifies the Ethernet interface
null	Specifies the null interface

Examples

The following sample output shows whether or not MPLS egress NetFlow accounting is enabled on the interface:

Router# show mpls interfaces internal

Interface Ethernet0/0/1:

        IP tagging enabled (tdp)

        TSP Tunnel tagging not enabled

        Tag Frame Relay Transport tagging not enabled

        Tagging operational

        IP to Tag Fast Feature Switching Vector

Tag Switching Turbo Feature Vector

        MTU = 1500, status=0x100043, appcount=1

        Output_feature_state=0x0 

---

Note As shown above, output_feature_state=0x0; therefore, MPLS egress NetFlow accounting is disabled.

---

Tag VPI = 1, Control VC = 0/32

Interface Ethernet0/0/2: 

        IP tagging enabled (tdp)

        TSP Tunnel tagging not enabled

        Tag Frame Relay Transport tagging not enabled

        Tagging operational

        IP to Tag Fast Feature Switching Vector

        Tag Switching Turbo Feature Vector

        MTU = 1500, status=0x100043, appcount=1

        Output_feature_state=0x1 

---

Note As shown above, output_feature_state=0x1; therefore, MPLS egress NetFlow accounting is enabled.

---

Tag VPI = 1, Control VC = 0/32

Interface ATM1/0/0.1:

        IP tagging enabled (tdp)

Related Commands

Command	Description
debug mpls netflow	Enables debugging of MPLS egress NetFlow accounting.
show mpls interfaces	Displays a message that the quick flag is set for all prefixes learned from the enabled MPLS egress NetFlow accounting interface.

Glossary

BGP—Border Gateway Protocol. An interdomain routing protocol that replaces Exterior Border Gateway Protocol (EGP). BGP exchanges reachability information with other BGP systems. It is defined by RFC 1163.

Border Gateway Protocol—See BGP.

BGP/MPLS/VPN—A VPN solution that uses MPLS and BGP protocol to allow multiple remote customer sites to be connected over an IP backbone. Refer to RFC 2547 for details.

CE router—A customer edge router. A router that is part of a customer network and interfaces to a PE router.

customer network—A network that is under the control of an end customer. A customer network can use private addresses as defined in RFC 1918. Customer networks are logically isolated from each other and from the provider network. A customer network is also known as a C network.

egress PE—The provider edge router through which traffic moves from the backbone to the destination VPN site.

flow—A set of packets with the same source IP address, destination IP address, source/destination ports, and type of service, and the same interface on which flow is monitored. Ingress flows are associated with the input interface, and egress flows are associated with the output interface.

ingress PE—The provider edge router through which traffic enters the backbone (provider network) from a VPN site.

label—A short, fixed-length identifier that tells switching nodes how the data (packets or cells) should be forwarded.

MPLS—Multiprotocol label switching. An emerging industry standard on which label switching is based.

multiprotocol label switching—See MPLS.

Open Shortest Path First—See OSPF.

OSPF—Open Shortest Path First. A link-state, hierarchical Interior Gateway Protocol (IGP) routing algorithm proposed as a successor to RIP in the Internet community. OSPF features include least-cost routing, multipath routing, and load balancing.

PE router—A provider edge router. A router at the edge of a provider network that interfaces to CE routers.

provider network—A backbone network that is under the control of a service provider and provides transport among customer sites. A provider network is also known as the P network.

virtual private network—See VPN.

VPN—Virtual private network. A network that enables IP traffic to use tunneling to travel securely over a public TCP/IP network.

VRF—VPN routing and forwarding instance. A VRF consists of an IP routing table, a derived forwarding table, a set of interfaces that use the forwarding table, and a set of rules and routing protocols that determine what goes into the forwarding table. In general, a VRF includes the routing information that defines a customer VPN site that is attached to a PE router.The VRF is a key element in the MPLS VPN technology. VRFs exist only on PE routers. A VRF is populated with VPN routes and allows multiple routing tables in a PE router. One VRF is required per VPN on each PE router in the VPN.

CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0601R)

Copyright © 2006 Cisco Systems, Inc. All rights reserved.