To configure which applications which will receive an alarm or notification, use the actioncommand in policy react configuration mode and policy inline react configuration mode. To disable the sending alarms or notifications, use the no form of this command.

Syntax Description

Command Default

Information is saved to syslog.

Command Modes

Policy react configuration (config-pmap-c-react)
Policy inline react configuration (config-spolicy-inline-react)

Command History

Usage Guidelines

You can configure multiple action commands to allow more than one recipients to receive an alarm or notification.

Router(config)# policy-map type performance-monitor policy-4
Router(config-pmap)# class PM-CLASS-4
Router(config-pmap-c)# react 2000 rtp-jitter-average
Router(config-pmap-c-react)# action snmp

Router(config)# interface ethernet 0/0
Router(config-if)# service-policy type performance-monitor inline input
Router(config-if-spolicy-inline)# react 2000 rtp-jitter-average
Router(config-spolicy-inline-react)# action snmp

Related Commands

To configure the severity of alarms sent for a Performance Monitor policy, use the alarm severitycommand in policy react configuration mode and policy inline react configuration mode. To return to the default and send all alarms, use the no form of this command.

Syntax Description

Command Default

All alarm severities are sent.

Command Modes

Policy react configuration (config-pmap-c-react)
Policy inline react configuration (config-spolicy-inline-react)

Command History

Usage Guidelines

The definition of the alarms types are listed below in order of severity:

• Emergency--System unusable
• Alert--Immediate action needed
• Critical--Critical condition
• Error--Error condition

Router(config)# policy-map type performance-monitor policy-4
Router(config-pmap)# class PM-CLASS-4
Router(config-pmap-c)# react 2000 rtp-jitter-average
Router(config-pmap-c-react)# alarm severity emergency

Router(config)# interface ethernet 0/0
Router(config-if)# service-policy type performance-monitor inline input
Router(config-if-spolicy-inline)# react 2000 rtp-jitter-average
Router(config-spolicy-inline-react)# alarm severity emergency

Related Commands

To configure the types of alarms sent for a Performance Monitor policy, use the alarm typecommand in policy react configuration mode and policy inline react configuration mode. To return to the default and send all alarms, use the no form of this command.

Syntax Description

Command Default

Alarm type is set to discrete.

Command Modes

Policy react configuration (config-pmap-c-react)
Policy inline react configuration (config-spolicy-inline-react)

Command History

Usage Guidelines

The monitored event is specified by the react command. You can group alarms by whether they exceed a specified percentage or count.

Router(config)# policy-map type performance-monitor policy-4
Router(config-pmap)# class PM-CLASS-4
Router(config-pmap-c)# react 2000 rtp-jitter-average
Router(config-pmap-c-react)# alarm type percent 80

Router(config)# interface ethernet 0/0
Router(config-if)# service-policy type performance-monitor inline input
Router(config-if-spolicy-inline)# react 2000 rtp-jitter-average
Router(config-spolicy-inline-react)# alarm type percent 80

Related Commands

To create a class map to be used for matching packets to a specified class, use the class-mapcommand in global configuration mode. To remove an existing class map from the router, use the no form of this command. The class-map command enters class-map configuration mode in which you can enter one of the match commands to configure the match criteria for this class.

Syntax Description

Command Default

No class map is configured by default.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

Only the class-map-name argument is available.

Cisco 2600, 3660, 3845, 6500, 7200, 7401, 7500, and ASR 1000 Series Routers

Use the class-mapcommand to specify the class that you will create or modify to meet the class-map match criteria. This command enters class-map configuration mode in which you can enter one of the match commands to configure the match criteria for this class. Packets that arrive at either the input interface or the output interface (determined by how the service-policycommand is configured) are checked against the match criteria configured for a class map to determine if the packets belong to that class.

When configuring a class map, you can use one or more match commands to specify match criteria. For example, you can use the matchaccess-group command, the matchprotocol command, or thematchinput-interface command. The match commands vary according to the Cisco IOS release. For more information about match criteria and match commands, see the "Modular Quality of Service Command-Line Interface (CLI) (MQC)" chapter of the Cisco IOS Quality of Service Solutions Configuration Guide .

Cisco 7600 Series Routers

You apply the class-map command and its commands on a per-interface basis to define packet classification, marking, aggregate, and flow policing as part of a globally named service policy.

You can attach a service policy to an EtherChannel. Do not attach a service policy to a port that is a member of an EtherChannel.

After the router is in class-map configuration mode, the following configuration commands are available:

• exit --Used to exit from class-map configuration mode.
• no --Used to remove a match statement from a class map.
• match --Used to configure classification criteria. The following optional match commands are available:
  • access-group {acl-index | acl-name}
  • ip {dscp | precedence} value1value2...value8

The following commands appear in the CLI help but are not supported on LAN interfaces or WAN interfaces on the Optical Service Modules (OSMs):

• input-interface {interface-typeinterface-number | nullnumber | vlanvlan-id
• protocol link-type
• destination-address mac mac-address
• source-address mac mac-address

OSMs are not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 32.

Policy Feature Card (PFC) QoS does not support the following commands:

• input-interface {interface-typeinterface-number | nullnumber | vlanvlan-id
• protocol link-type
• destination-address mac mac-address
• source-address mac mac-address
• qos-group group-value

If you enter these commands, PFC QoS does not detect the unsupported keywords until you attach a policy map to an interface. When you try to attach the policy map to an interface, you get an error message. For additional information, see the Cisco 7600 Series Router Cisco IOS Software Configuration Guide and the Cisco IOS command references.

After you have configured the class-map name and are in class-map configuration mode, you can enter the matchaccess-groupand matchipdscp commands. The syntax for these commands is as follows:

match [[access-group {acl-index | acl-name}] | [ipdscp | precedence} value]]

See the table below for a syntax description of the match commands.

Router(config)# class-map class101
Router(config-cmap)# match access-group 101

Router(config)# load protocol disk2:ip.phdf
Router(config)# load protocol disk2:udp.phdf
Router(config)# class-map type stack match-all ip-udp
Router(config-cmap)# description "match UDP over IP packets"
Router(config-cmap)# match field ip protocol eq 0x11 next udp
Router(config)# class-map type access-control match-all slammer
Router(config-cmap)# description "match on slammer packets"
Router(config-cmap)# match field udp dest-port eq 0x59A
Router(config-cmap)# match field ip length eq 0x194
Router(config-cmap)# match start 13-start offset 224 size 4 eq 0x
4011010

Router(config)# class-map type port-filter pf-class
Router(config-cmap)# match not port udp 123
Router(config-cmap)# match closed-ports
Router(config-cmap)# exit
Router(config)# policy-map type port-filter pf-policy
Router(config-pmap)# class pf-class
Router(config-pmap-c)# drop
Router(config-pmap-c)# end

Router(config)# class-map ipp5
Router(config-cmap)# match ip precedence 5

Router> enable
Router# configure terminal
Router(config)# class-map cos1
Router(config-cmap)# match cos 0
Router(config-pmap-c)# end

Router> enable
Router# configure terminal
Router(config)# class-map exp7
Router(config-cmap)# match mpls experimental topmost 2
Router(config-pmap-c)# end

Related Commands

To clear counters for the Performance Monitor component of Feature Monitor, use the clear fm performance-monitor counterscommand in privileged EXEC mode.

Syntax Description

This command has no arguments or keywords.

Command Default

Counters for the Performance Monitor are not cleared.

Command Modes

Privileged EXEC (#)

Command History

Usage Guidelines

This command is available only on the Catalyst 6500 platform.

Router# clear fm performance-monitor counters

Related Commands

To configure the rate for the RTP packet time-stamp clock, use the clock-ratecommand in policy RTP configuration mode. To remove the configuration, use the no form of this command.

Syntax Description

Command Default

Clock rate is 90000.

Command Modes

policy RTP configuration (config-pmap-c-mrtp)
policy inline RTP configuration (config-spolicy-inline-mrtp)

Command History

Usage Guidelines

For more information about how the clock rate for RTP packet time-stamp clock is used to calculate the packet arrival latency, see RFC 3550, RTP, A Transport Protocol for Real-Time Applications . The clock rate has to be synchronized with the routers along the path of the flow. Because the clock rate can vary depending on the payload codec type, a keyword is provided to set the expected clock rate.

The available values for type-name and type-numberare celb (25), cn (13), dvi4 (5) (8000 Hz as described in RFC 3551, RTP Profile for Audio and Video Conferences with Minimal Control ), dvi4-2 (6) (8000 Hz as described in RFC 3551), dvi4-3 (16) (DVI4 Dipol 11025 Hz), dvi4-4 (17) DVI4 Dipol 22050 Hz), g722 (9), g723 (4), g728 (15), g729 (18), gsm (3), h261 (31), h263 (34), jpeg (26), l16 (11) (L16 channel 1), l16-2 (10) (L16 channel 2), lpc (7), mp2t (33), mpa (14), mpv (32), nv (28), pcma (8), pcmu (0), qcelp (12).

Router(config)# policy-map type performance-monitor policy-4
Router(config-pmap)# class PM-CLASS-4
Router(config-pmap-c)# monitor metric rtp
Router(config-pmap-c-mrtp)# clock-rate 8 9600

Router(config)# interface ethernet 0/0
Router(config-if)# service-policy type performance-monitor inline input
Router(config-if-spolicy-inline)# monitor metric rtp
Router(config-spolicy-inline-mrtp)# clock-rate 8 9600

Related Commands

To configure one or more of the application description field as a nonkey field for a flow record, use the collect application description command in flow record configuration mode. To disable the use the application fields as a key field for a flow record, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The application description field is not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect application description

Related Commands

To configure one of the application media fields as a nonkey field for a flow record, use the collect application media command in flow record configuration mode. To disable the use of one of the application media field as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The application media field is not configured as a nonkey field for a user-defined flow record.

Command Modes

flow record configuration (config-flow-record)

Command History

Usage Guidelines

The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Router(config)# flow record type performance-monitor PM-RECORD-4
Router(config-flow-record)# collect application media packets

Related Commands

To configure the use of the application name as a nonkey field for a flow record, use the collect application name command in flow record configuration mode. To disable the use of the application name as a nonkey field for a flow record, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The application name is not configured as a non-key field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect application name

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect application name

Related Commands

To configure one or more of the application vendor field as a nonkey field for a flow record, use the collect application vendor command in flow record configuration mode. To disable the use the application fields as a key field for a flow record, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The application vendor field is not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect application vendor

Related Commands

To configure one or more of the application version field as a nonkey field for a flow record, use the collect application version command in flow record configuration mode. To disable the use the application fields as a key field for a flow record, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The application version field is not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect application version

Related Commands

To configure various connection information fields as a nonkey field for a flow record, use the collect connection command in flow record configuration mode. To disable the use of the connection information fields as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

Connection information fields are not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

The initiator keyword provides the following information about the direction of the flow.

• 0x00=undefined
• 0x01=initiator - the flow source is initiator of the connection.
• 0x02=reverseInitiator - the flow destination is the initiator of the connection.

For the new-translations and sum-duration keywords, the observation period can be specified by the start and end timestamps for the flow.

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect connections initiator

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect connections initiator

Related Commands

To configure the number of bytes or packets in a flow as a nonkey field for a Flexible NetFlow flow record, use the collect counter command in Flexible NetFlow flow record configuration mode. To disable the use of the number of bytes or packets in a flow (counters) as a nonkey field for a Flexible NetFlow flow record, use the no form of this command.

Syntax Description

Command Default

The number of bytes or packets in a flow is not configured as a nonkey field.

Command Modes

Flexible NetFlow flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.

The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

The rate and droppedkeywords were added and the replicated and squared longkeywords are not available. You must first enter the flow record type performance-monitor command.

collect counter bytes

This command configures a 32-bit counter for the number of bytes seen in a flow.

collect counter packets

This command configures a 32-bit counter that is incremented for each packet seen in the flow. For extremely long flows it is possible for this counter to restart at 0 (wrap) when it reaches the limit of approximately 4 billion packets. On detection of a situation that would cause this counter to restart at 0, a flow monitor with a normal cache type exports the flow and starts a new flow.

collect counter packets long

This command configures a 64-bit counter that will be incremented for each packet seen in the flow. It is unlikely that a 64-bit counter will ever restart at 0.

collect counter bytes squared long

This counter can be used in conjunction with the byte and packet counters in order to calculate the variance of the packet sizes. Its value is derived from squaring each of the packet sizes in the flow and adding the results. This value can be used as part of a standard variance function.

The variance and standard deviation of the packet sizes for the flow can be calculated with the following formulas:

cbs: value from the counter bytes squared field

pkts: value from the counter packets field

bytes: value from the counter bytes field

Variance = (cbs/pkts) - (bytes/pkts)2

Standard deviation = square root of Variance

Example 1:

Packet sizes of the flow: 100, 100, 100, 100

Counter packets: 4

Counter bytes: 400, mean packet size = 100

Counter bytes squared: 40,000

Variance = (40,000/4) - (400/4)2 = 0

Standard Deviation = 0

Size = 100 +/- 0

Example 2:

Packet sizes of the flow: 50, 150, 50, 150

Counter packets: 4

Counter bytes: 400, mean packet size = 100

Counter bytes squared: 50,000

Variance = (50,000/4) - (400/4)2 = 2500

Standard deviation = 50

Size = 100 +/- 50

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect counter bytes

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect counter bytes long

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect counter bytes squared long

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect counter packets

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect counter packets long

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect counter packets long

Related Commands

To configure the use of MAC addresses as a nonkey field for a Flexible NetFlow flow record, use the collectdatalinkmac command in Flexible NetFlow flow record configuration mode. To disable the use of Layer 2 MAC addresses as a non-key field for a Flexible NetFlow flow record, use the no form of this command.

Syntax Description

Command Default

MAC addresses are not configured as a nonkey field.

Command Modes

Flexible NetFlow flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitorcommand before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

The input and output keywords of the collectdatalinkmac command are used to specify the observation point that is used by the collectdatalinkmac command to capture the MAC addressees from network traffic. For example, when you configure a flow record with the collectdatalinkmacdestinationaddressinputcommand to monitor the simulated denial of service (DoS) attack in the figure below and apply the flow monitor to which the flow record is assigned in either input (ingress) mode on interface Ethernet 0/0.1 on R3 or output (egress) mode on interface Ethernet 1/0.1 on R3, the observation point is always Ethernet 0/0.1 on R3. The destination MAC address that is collected is aaaa.bbbb.cc04.

When the destination output mac address is configured, the value is the destination mac address of the output packet, even if the monitor the flow record is applied to is input only.

When the destination input mac address is configured, the value is the destination mac address of the input packet, even if the monitor the flow record is applied to is output only.

When the source output mac address is configured, the value is the source mac address of the output packet, even if the monitor the flow record is applied to is input only.

When the source input mac address is configured, the value is the source mac address of the input packet, even if the monitor the flow record is applied to is output only.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect datalink mac destination address input

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect datalink mac source address output

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect datalink mac source address output

Related Commands

To configure the flow direction, the flow sampler ID number, or reason why the flow ended as a nonkey field for a flow record, use the collect flow command in flow record configuration mode. To disable the use of the flow direction and the flow sampler ID number as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The flow direction and the flow sampler ID number are not configured as nonkey fields.

Command Modes

flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.

The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

collect flow direction

This field indicates the direction of the flow. This is of most use when a single flow monitor is configured for input and output flows. It can be used to find and eliminate flows that are being monitored twice, once on input and once on output. This field may also be used to match up pairs of flows in the exported data when the two flows are flowing in opposite directions.

collect flow sampler

This field contains the ID of the flow sampler used to monitor the flow. This is useful when more than one flow sampler is being used with different sampling rates. The flow exporter option sampler-table command exports options records with mappings of the flow sampler ID to sampling rate so the collector can calculate the scaled counters for each flow.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect flow sampler

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect flow direction

Related Commands

To configure the input and output interface as a nonkey field for a flow record, use the collect interface command in flow record configuration mode. To disable the use of the input and output interface as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The input and output interface is not configured as a nonkey field.

Command Modes

flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.

The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the flow record type performance-monitor command.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect interface input

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect interface output

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect interface input

Related Commands

To configure one or more of the IPv4 fields as a nonkey field for a flow record, use the collect ipv4 command in flow record configuration mode. To disable the use of one or more of the IPv4 fields as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The IPv4 fields are not configured as a nonkey field.

Command Modes

flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.

The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Note

Some of the keywords of the collect ipv4 command are documented as separate commands. All of the keywords for the collect ipv4 command that are documented separately start with collect ipv4. For example, for information about configuring the IPv4 time-to-live (TTL) field as a nonkey field and collecting its value for a flow record, refer to the collect ipv4 ttl command.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

Only the the dscp keyword is available. You must first enter the flow record type performance-monitor command.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv4 dscp

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv4 dscp

Related Commands

To configure the IPv4 destination address as a nonkey field for a flow record, use the collect ipv4 destination command in flow record configuration mode. To disable the use of an IPv4 destination address field as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The IPv4 destination address is not configured as a nonkey field.

Command Modes

flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.

The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

Only the maskand minimum-maskkeywords are available. You must first enter the flow record type performance-monitor command.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv4 destination prefix minimum-mask 16

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv4 destination prefix minimum-mask 16

Related Commands

To configure the IPv4 fragmentation flags and the IPv4 fragmentation offset as a nonkey field for a flow record, use the collect ipv4 fragmentation command in flow record configuration mode. To disable the use of the IPv4 fragmentation flags and the IPv4 fragmentation offset as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The IPv4 fragmentation flags and the IPv4 fragmentation offset are not configured as nonkey fields.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

collect ipv4 fragmentation flags

This field collects the "don't fragment" and "more fragments" flags.

Bit 0: reserved, must be zero.

Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment

Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments

Bits 3-7: (DC) Don't Care, value is irrelevant

        0   1   2   3   4   5   6   7
      +---+---+---+---+---+---+---+---+
      |   | D | M | D | D | D | D | D |
      | 0 | F | F | C | C | C | C | C |
      +---+---+---+---+---+---+---+---+

For more information on IPv4 fragmentation flags, see RFC 791 Internet Protocol at the following URL: http://www.ietf.org/rfc/rfc791.txt .

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv4 fragmentation flags

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv4 fragmentation flags

Related Commands

To configure a section of an IPv4 packet as a nonkey field for a flow record, use the collect ipv4 section command in flow record configuration mode. To disable the use of a section of an IPv4 packet as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

A section of an IPv4 packet is not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

It is recommended that you configure both header size and payload size so that you know how much data is going to be captured.

collect ipv4 section header

This command causes the first IPv4 header to be copied into the flow record for this flow. Only the configured size in bytes will be copied and part of the payload will also be captured if the configured size is larger than the size of the header.

Note	This command can result in large records which use a lot of router memory and export bandwidth.

collect ipv4 section payload

This command results in a copy of the first IPv4 payload being put into the flow record for this flow. Only the configured size in bytes will be copied and may end in a series of 0's if the configured size is greater than the size of the payload.

Note	This command can result in large records which use a lot of router memory and export bandwidth.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv4 section header size 8

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv4 section payload size 16

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv4 section payload size 16

Related Commands

To configure the IPv4 source address as a nonkey field for a flow record, use the collect ipv4 source command in flow record configuration mode. To disable the use of the IPv4 source address field as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The IPv4 source address is not configured as a nonkey field.

Command Modes

flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.

The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

Only the maskand minimum-maskkeywords are available. You must first enter the flow record type performance-monitor command.

collect ipv4 source prefix minimum-mask

The source address prefix is the network part of an IPv4 source address. The optional minimum mask allows more information to be gathered about large networks.

collect ipv4 source mask minimum-mask

The source address mask is the number of bits that make up the network part of the source address. The optional minimum mask allows a minimum value to be configured. This command is useful when there is a minimum mask configured for the source prefix field and the mask is to be used with the prefix. In this case, the values configured for the minimum mask should be the same for the prefix and mask fields.

Alternatively, if the collector is aware of the minimum mask configuration of the prefix field, the mask field can be configured without a minimum mask so that the true mask and prefix can be calculated.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv4 source prefix minimum-mask 16

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv4 source prefix minimum-mask 16

Related Commands

To configure the IPv4 total-length field as a nonkey field for a flow record, use the collect ipv4 total-length command in flow record configuration mode. To disable the use of the IPv4 total-length field as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The IPv4 total-length field is not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

collect ipv4 total-length [minimum | maximum]

This command is used to collect the lowest and highest IPv4 total length values seen in the lifetime of the flow. Configuring this command results in more processing than is needed to simply collect the first total length value seen using the collect ipv4 total-length command.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv4 total-length

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv4 total-length minimum

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv4 total-length minimum

Related Commands

To configure the IPv4 time-to-live (TTL) field as a nonkey field for a flow record, use the collect ipv4 ttl command in flow record configuration mode. To disable the use of the IPv4 TTL field as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The IPv4 time-to-live (TTL) field is not configured as a nonkey field.

Command Modes

flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.

The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the flow record type performance-monitor command.

collect ipv4 ttl [minimum | maximum]

This command is used to collect the lowest and highest IPv4 TTL values seen in the lifetime of the flow. Configuring this command results in more processing than is needed to simply collect the first TTL value seen using the collect ipv4 ttl command.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv4 ttl maximum

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv4 ttl minimum

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv4 ttl minimum

Related Commands

To configure one or more of the IPv6 fields as a nonkey field for a flow record, use the collect ipv6 command in flow record configuration mode. To disable the use of one or more of the IPv6 fields as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The IPv6 fields are not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Note

Some of the keywords for the collect ipv6 command are documented as separate commands. All of the keywords for the collect ipv6 command that are documented separately start with collect ipv6. For example, for information about configuring the IPv6 hop limit field as a nonkey field and collecting its value for a flow record, refer to the collect ipv6 hop-limit command.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv6 dscp

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv6 dscp

Related Commands

To configure the IPv6 destination address as a nonkey field for a flow record, use the collect ipv6 destination command in flow record configuration mode. To disable the use of an IPv6 destination address field as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

TheIPv6 destination address is not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv6 destination prefix minimum-mask 16

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv6 destination prefix minimum-mask 16

Related Commands

To configure the bitmap of the IPv6 extension header map as a nonkey field for a flow record, use the collect ipv6 extension map command in flow record configuration mode. To disable the use of the IPv6 bitmap of IPv6 extension header map as a nonkey field for a flow record, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The use of the bitmap of the IPv6 extension header map is not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Bitmap of the IPv6 Extension Header Map

The bitmap of IPv6 extension header map is made up of 32 bits.

    0     1     2     3     4     5     6     7
+-----+-----+-----+-----+-----+-----+-----+-----+
| Res | FRA1| RH  | FRA0| UNK | Res | HOP | DST |
+-----+-----+-----+-----+-----+-----+-----+-----+
    8     9    10    11    12    13    14    15
+-----+-----+-----+-----+-----+-----+-----+-----+
| PAY | AH  | ESP |         Reserved            |
+-----+-----+-----+-----+-----+-----+-----+-----+
   16    17    18    19    20    21    22    23
+-----+-----+-----+-----+-----+-----+-----+-----+
|                  Reserved                     |
+-----+-----+-----+-----+-----+-----+-----+-----+
   24    25    26    27    28    29    30    31
+-----+-----+-----+-----+-----+-----+-----+-----+
|                  Reserved                     |
+-----+-----+-----+-----+-----+-----+-----+-----+
0  Res  Reserved
1  FRA1 Fragmentation header - not first fragment
2  RH   Routing header
3  FRA0 Fragment header - first fragment
4  UNK  Unknown Layer 4 header
        (compressed, encrypted, not supported)
5  Res  Reserved
6  HOP  Hop-by-hop option header
7  DST  Destination option header
8  PAY Payload compression header
9  AH  Authentication Header
10 ESP Encrypted security payload
11 to 31 Reserved

For more information on IPv6 headers, refer to RFC 2460 Internet Protocol, Version 6 (IPv6) at the following URL: http://www.ietf.org/rfc/rfc2460.txt .

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv6 extension map

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv6 extension map

Related Commands

To configure one or more of the IPv6 fragmentation fields as a nonkey field for a flow record, use the collect ipv6 fragmentation command in flow record configuration mode. To disable the use one or more of the IPv6 fragmentation fields as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The use of one or more of the IPv6 fragmentation fields is not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv6 fragmentation flags

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv6 fragmentation flags

Related Commands

To configure the IPv6 hop limit as a nonkey field for a flow record, use the collect ipv6 hop-limit command in flow record configuration mode. To disable the use of the IPv6 hop limit field as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The IPv6 hop limit is not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

collect ipv6 hop-limit [minimum | maximum]

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

This command is used to collect the lowest and highest IPv6 hop limit values seen in the lifetime of the flow. Configuring this command results in more processing than is needed to simply collect the first hop limit value seen using the collect ipv6 hop-limit command.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv6 hop-limit maximum

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv6 hop-limit maximum

Related Commands

To configure one or more of the IPv6 length fields as a nonkey field for a flow record, use the collect ipv6 lengthcommand in flow record configuration mode. To disable the use of one or more of the IPv6 length fields as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The IPv6 length fields are not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

collect ipv6 length [minimum | maximum]

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

This command is used to collect the lowest and highest IPv6 length values seen in the lifetime of the flow. Configuring this command results in more processing than is needed to simply collect the length value seen using the collect ipv6 length command.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv6 length header

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv6 length header

Related Commands

To configure a section of an IPv6 packet as a nonkey field for a flow record, use the collect ipv6 section command in flow record configuration mode. To disable the use of a section of an IPv6 packet as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

A section of an IPv6 packet is not configured as a non-key field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

It is recommended that you configure both header size and payload size so that you know how much data is going to be captured.

Note	The IPv6 payload data is captured only if the first packet in the flow is an IPv6 packet. If the first packet in the flow is not an IPv6 packet, information from other packets in the flow such as packet and byte counters, is still captured.

collect ipv6 section header

This command causes a copy of the first IPv6 header to be put into the flow record for this flow. Only the configured size in bytes will be copied, and part of the payload will also be captured if the configured size is larger than the size of the header.

Note	Configuring this command can result in large records that use a lot of router memory and export bandwidth.

collect ipv6 section payload

This command causes a copy of the first IPv6 payload to be put into the flow record for this flow. Only the configured size in bytes will be copied, and it may end in a series of zeros if the configured size is smaller than the size of the payload.

Note	Configuring this command can result in large records that use a lot of router memory and export bandwidth.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv6 section header size 8

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv6 section payload size 16

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv6 section payload size 16

Related Commands

To configure the IPv6 source address as a nonkey field for a flow record, use the collect ipv6 source command in flow record configuration mode. To disable the use of the IPv6 source address field as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The IPv6 source address is not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

collect IPv6 source prefix minimum mask

The source address prefix field is the network part of the source address. The optional minimum mask allows more information to be gathered about large networks.

collect IPv6 source mask minimum mask

The source address mask is the number of bits that make up the network part of the source address. The optional minimum mask allows a minimum value to be configured. This command is useful when there is a minimum mask configured for the source prefix field and the mask is to be used with the prefix. In this case, the values configured for the minimum mask should be the same for the prefix and mask fields.

Alternatively, if the collector is aware of the minimum mask configuration of the prefix field, the mask field can be configured without a minimum mask so that the true mask and prefix can be calculated.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect ipv6 source prefix minimum-mask 16

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect ipv6 source prefix minimum-mask 16

Related Commands

To configure one or more of the metadata fields as a nonkey field for a flow record, use the collect metadata command in flow record configuration mode. To disable the use the metadata fields as a key field for a flow record, use the no form of this command.

Syntax Description

Command Default

The metadata fields are not configured as nonkey fields.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Router(config)# flow record RECORD-1
Router(config-flow-record)# collect metadata global-session-id

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect metadata global-session-id

Related Commands

To configure the monitor event field as a nonkey field for a flow record, use the collect monitor event command in flow record configuration mode. To disable the use of a monitor event field as a nonkey field for a flow record, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The monitor event field is not configured as a nonkey field for a user-defined flow record.

Command Modes

flow record configuration (config-flow-record)

Command History

Usage Guidelines

Monitor events are recorded using two bits. Bit 1 is not used. Bit 2 indicates that no media application packets were seen, in other words, a Media Stop Event occured.

The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Router(config)# flow record type performance-monitor PM-RECORD-4
Router(config-flow-record)# collect monitor event

Related Commands

To configure one or more of the routing attributes as a nonkey field for a flow record, use the collect routing command in flow record configuration mode. To disable the use of one or more of the routing attributes as a nonkey field for a flow record, use the no form of this command.

Syntax Description

Command Default

The routing attributes are not configured as a nonkey field.

Command Modes

flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.

The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

The reason keywordwas added and only the forwarding-statu s keyword is available. You must first enter the flow record type performance-monitor command.

collect routing source as [peer]

This command collects the 16-bit autonomous system number based on a lookup of the router's routing table using the source IP address. The optional peer keyword provides the expected next network, as opposed to the originating network.

collect routing source as 4-octet [peer 4-octet]

This command collects the 32-bit autonomous system number based on a lookup of the router's routing table using the source IP address. The optional peer keyword provides the expected next network, as opposed to the originating network.

collect routing destination as [peer]

This command collects the 16-bit autonomous system number based on a lookup of the router's routing table using the destination IP address. The optional peer keyword provides the expected next network as opposed to the destination network.

collect routing destination as 4-octet [peer 4-octet]

This command collects the 32-bit autonomous system number based on a lookup of the router's routing table using the destination IP address. The peer keyword will provide the expected next network as opposed to the destination network.

collect routing destination traffic-index

This command collects the traffic-index field based on the destination autonomous system for this flow. The traffic-index field is a value propagated through BGP.

This command is not supported for IPv6.

collect routing source traffic-index

This command collects the traffic-index field based on the source autonomous system for this flow. The traffic-index field is a value propagated through BGP.

This command is not supported for IPv6.

collect routing forwarding-status

This command collects a field to indicate if the packets were successfully forwarded. The field is in two parts and may be up to 4 bytes in length. For the releases specified in the Command History table, only the status field is used:

    +-+-+-+-+-+-+-+-+
    | S | Reason    |
    | t | codes     |
    | a | or        |
    | t | flags     |
    | u |           |
    | s |           |
    +-+-+-+-+-+-+-+-+
     0 1 2 3 4 5 6 7
  Status:
  00b=Unknown, 01b = Forwarded, 10b = Dropped, 11b = Consumed

collect routing vrf input

This command collects the VRF ID from incoming packets on a router. In the case where VRFs are associated with an interface via methods such as VRF Selection Using Policy Based Routing/Source IP Address, a VRF ID of 0 will be recorded. If a packet arrives on an interface that does not belong to a VRF, a VRF ID of 0 is recorded.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect routing source as 

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect routing destination as 

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect routing source traffic-index

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect routing forwarding-status

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect routing vrf input

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect routing forwarding-status reason

Related Commands

To configure the use of the is-multicast field (indicating that the IPv4 traffic is multicast traffic) as a nonkey field, use the collect routing is-multicastcommand in flow record configuration mode. To disable the use of the is-multicast field as a nonkey field for a flow record, use the no form of this command.

Syntax Description

This command has no arguments or keywords

Command Default

The is-multicast field is not configured as a nonkey field.

Command Modes

Flow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

Router(config)# flow record FLOW-RECORD-1
Router(config-flow-record)# collect routing is-multicast

Router(config)# flow record type performance-monitor RECORD-1
Router(config-flow-record)# collect routing is-multicast

Related Commands

To configure the multicast replication factor value for IPv4 traffic as a nonkey field for a flow record, use the collect routing multicast replication-factorcommand in flow record configuration mode. To disable the use of the multicast replication factor value as a nonkey field for a flow record, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The multicast replication factor value is not configured as a nonkey field.

Command Modes

Fow record configuration (config-flow-record)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.

Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.

The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.

When the replication-factor field is used in a flow record, it will only have a non-zero value in the cache for ingress multicast traffic that is forwarded by the router. If the flow record is used with a flow monitor in output (egress) mode or to monitor unicast traffic or both, the cache data for the replication factor field is set to 0.