Cisco IOS Software Releases 12.3 Mainline

Table Of Contents

NetFlow Multicast Support

Contents

Prerequisites for NetFlow Multicast Support

Restrictions for NetFlow Multicast Support

Information About NetFlow Multicast Support

Multicast Ingress and Multicast Egress Accounting

NetFlow Multicast Flow Records

How to Configure NetFlow Multicast Support

Configuring NetFlow Multicast Egress Accounting

Configuring NetFlow Multicast Ingress Accounting

Enabling Accounting for Multicast Data That Fails the RPF Check

Verifying the Configuration

Troubleshooting Tips

Configuration Examples for NetFlow Multicast Support

Configuring NetFlow Multicast Egress Accounting on an Ethernet Interface: Example

Configuring NetFlow Multicast Ingress Accounting on an Ethernet Interface: Example

Enabling Accounting for Multicast Data That Fails the RPF Check: Example

Verifying the Configuration: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

ip multicast netflow

ip multicast netflow rpf-failure

show ip cache flow aggregation

show ip cache verbose flow

Glossary

NetFlow Multicast Support

---

The NetFlow Multicast Support feature lets you capture multicast-specific data (both packets and bytes) for multicast flows. For example, you can capture the packet-replication factor for a specific flow as well as for each outgoing stream. This feature provides complete end-to-end usage information about network traffic for a complete multicast traffic billing solution.

The NetFlow Multicast Support feature can identify and count multicast packets on the ingress side or the egress side (or both sides) of a router. Multicast ingress accounting provides information about the source and the number of times the traffic was replicated, and multicast egress accounting monitors the destination of the traffic flow.

The NetFlow Multicast Support feature lets you enable NetFlow statistics to account for all packets that fail the reverse path forwarding (RPF) check that are dropped in the core of the service provider network. Accounting for RPF-failed packets provides more accurate traffic statistics and patterns.

History for the NetFlow Multicast Support Feature

Release	Modification
12.3(1)	This feature was introduced.
12.2(18)S	This feature was integrated into Cisco IOS Release 12.2(18)S.
12.2(27)SBC	This feature was integrated into Cisco IOS Release 12.2(27)SBC.
12.2(18)SXF	This feature was integrated into Cisco IOS Release 12.2(18)SXF.

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Contents

•Prerequisites for NetFlow Multicast Support

•Restrictions for NetFlow Multicast Support

•Information About NetFlow Multicast Support

•How to Configure NetFlow Multicast Support

•Configuration Examples for NetFlow Multicast Support

•Additional References

•Command Reference

•Glossary

Prerequisites for NetFlow Multicast Support

Release 12.2(18)SXF and later 12.2(SX) releases

Before you can configure the NetFlow Multicast Support feature, you must configure:

•Multicast routing

•NetFlow v9 (version 9) data export (otherwise, multicast data is visible in the cache but is not exported)

All other Cisco IOS Releases

Before you can configure the NetFlow Multicast Support feature, you must configure:

•Multicast fast switching or multicast distributed fast switching (MDFS); multicast CEF switching is not supported.

•Multicast routing.

•NetFlow v9 (Version 9) data export. (Otherwise, multicast data is visible in the cache but is not exported.)

Restrictions for NetFlow Multicast Support

Memory Impact

If traffic is heavy, the additional flows might fill the global flow hash table. If you must increase the size of the global flow hash table, you must also add memory to the router.

NetFlow has a maximum cache size of 65,536 flow record entries of 64 bytes each. To deduce the packet-replication factor, multicast accounting adds 16 bytes (for a total of 80 bytes) to each multicast flow record.

Performance Impact

Ingress multicast accounting does not greatly affect performance. Because of the additional accounting-related computation that occurs in the traffic-forwarding path of the router, egress NetFlow multicast accounting might degrade network performance slightly, but does not limit the functionality of the router.

Multicast Addresses

NetFlow data cannot be exported to multicast addresses.

Information About NetFlow Multicast Support

To configure the NetFlow Multicast Support feature, you must understand the following concepts:

•Multicast Ingress and Multicast Egress Accounting

•NetFlow Multicast Flow Records

Multicast Ingress and Multicast Egress Accounting

The NetFlow Multicast Support feature lets you select either multicast ingress accounting, in which a replication factor (equal to the number of output interfaces) indicates the load, or multicast egress accounting, in which all outgoing multicast streams are processed as separate streams, or both. This lets you collect information about how much data is leaving the interfaces of the router (egress and multicast ingress accounting) or how much multicast data is received (multicast ingress accounting).

On the ingress side, multicast packets are counted like unicast packets, but with two additional fields (for number of replicated packets and byte count). With multicast ingress accounting, the destination interface field will be set to null, and the IP next hop field is set to zero for multicast flows.

NetFlow Multicast Flow Records

Multicast ingress accounting creates one flow record that indicates how many times each packet is replicated. Multicast egress accounting creates a unique flow record for each outgoing interface.

How to Configure NetFlow Multicast Support

See the following sections for configuration tasks for the NetFlow Multicast Support feature. Each task in the list is identified as either required or optional.

•Configuring NetFlow Multicast Egress Accounting (required)

•Configuring NetFlow Multicast Ingress Accounting (required)

•Enabling Accounting for Multicast Data That Fails the RPF Check (required)

•Verifying the Configuration (optional)

•Troubleshooting Tips (optional)

Configuring NetFlow Multicast Egress Accounting

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type number [name-tag]

4. ip multicast netflow egress

5. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number [name-tag] Example: Router(config)# interface fastethernet 0/0	Enters interface configuration mode.
Step 4	ip multicast netflow egress Example: Router(config-if)# ip multicast netflow egress	Enables NetFlow multicast egress accounting.
Step 5	end Example: Router(config-if)# end	Ends the configuration session and returns to privileged EXEC mode.

Configuring NetFlow Multicast Ingress Accounting

This section shows how to configure NetFlow multicast ingress accounting (which is enabled by default).

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type number [name-tag]

4. ip multicast netflow ingress

5. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number [name-tag] Example: Router(config)# interface fastethernet 1/0	Enters interface configuration mode.
Step 4	ip multicast netflow ingress Example: Router(config-if)# ip multicast netflow ingress	Enables NetFlow multicast ingress accounting.
Step 5	end Example: Router(config-if)# end	Ends the configuration session and returns to privileged EXEC mode.

Enabling Accounting for Multicast Data That Fails the RPF Check

This section shows how to enable accounting for multicast data that fails the RPF check.

SUMMARY STEPS

1. enable

2. configure terminal

3. ip multicast netflow rpf-failure

4. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip multicast netflow rpf-failure Example: Router(config)# ip multicast netflow rpf-failure	Enables accounting for multicast data that fails the RPF check.
Step 4	end Example: Router(config)# end	Ends the configuration session and returns to privileged EXEC mode.

Verifying the Configuration

This section shows how to verify successful configuration of NetFlow multicast accounting.

SUMMARY STEPS

1. show ip cache verbose flow

DETAILED STEPS

Command or Action	Purpose
show ip cache verbose flow Example: Router> show ip cache verbose flow	Displays the two additional fields related to multicast data (number of replicated packets and byte count).

Troubleshooting Tips

If there are no multicast flow records in the NetFlow cache, check the multicast switching counters for the existence of process-switched packets. (NetFlow accounts only for fast-switched or MDFS-switched packets.) If process-switched packets are present, then check the multicast distributed fast switching (MDFS) routing table to help determine potential problems.

Configuration Examples for NetFlow Multicast Support

This section provides the following configuration examples:

•Configuring NetFlow Multicast Egress Accounting on an Ethernet Interface: Example

•Configuring NetFlow Multicast Ingress Accounting on an Ethernet Interface: Example

•Enabling Accounting for Multicast Data That Fails the RPF Check: Example

•Verifying the Configuration: Example

Configuring NetFlow Multicast Egress Accounting on an Ethernet Interface: Example

The following example shows how to configure multicast egress NetFlow accounting on the egress Ethernet 0/0 interface:

Router> enable

Password:

Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# interface ethernet 0/0

 Router(config-if)# ip multicast netflow egress

 Router(config-if)# end

Router# 

000068: *May 2 20:15:24.710:%SYS-5-CONFIG_I: Configured from console by console

Router# exit

Configuring NetFlow Multicast Ingress Accounting on an Ethernet Interface: Example

The following example shows how to configure multicast ingress NetFlow accounting on the ingress Ethernet 1/0 interface:

Router> enable

Password:

Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# interface ethernet 1/0

 Router(config-if)# ip multicast netflow ingress

 Router(config-if)# end

Router# 

000070: *May 3 18:15:40.710:%SYS-5-CONFIG_I: Configured from console by console

Router# exit

Enabling Accounting for Multicast Data That Fails the RPF Check: Example

The following example shows how to enable accounting for multicast data that fails the RPF check:

Router> enable

Password:

Router# configure terminal

Router(config)# ip multicast netflow rpf-failure

Router(config)# end

Router# 

000071: *May 4 22:21:32.906:%SYS-5-CONFIG_I: Configured from console by console

Router# exit

Verifying the Configuration: Example

The following example shows how to verify successful configuration of NetFlow multicast accounting:

Router> show ip cache verbose flow

IP packet size distribution (5246 total packets):

   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480

   .800 .179 .000 .020 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608

   .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 4456704 bytes

  6 active, 65530 inactive, 322 added

  4977 ager polls, 0 flow alloc failures

  Active flows timeout in 30 minutes

  Inactive flows timeout in 10 seconds

IP Sub Flow Cache, 270472 bytes

  4 active, 16380 inactive, 56 added, 56 added to flow

  0 alloc failures, 0 force free

  1 chunk, 1 chunk added

  last clearing of statistics never

Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)

--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow

ICMP               116      0.0        31    30      0.8       0.6      10.4

Total:             116      0.0        31    30      0.8       0.6      10.4

SrcIf          SrcIPaddress    DstIf          DstIPaddress    Pr TOS Flgs  Pkts

Port Msk AS                    Port Msk AS    NextHop              B/Pk  Active

IPM:OPkts    OBytes

IPM:    0       0

Et1/1/1        10.0.0.1        Null           192.168.1.1       01 55  10     100

0000 /8  0                     0000 /0  0     0.0.0.0                28     0.0

IPM:  100    2800

Et1/1/1        10.0.0.1        Se2/1/1.16     192.168.1.1       01 55  10     100

0000 /8  0                     0000 /0  0     0.0.0.0                28     0.0

IPM:    0       0

Et1/1/2        10.0.0.1        Et1/1/4        192.168.2.1 01 55  10     100

0000 /8  0                     0000 /0  0     0.0.0.0                28     0.1

Et1/1/2        10.0.0.1        Null           192.168.2.1 01 55  10     100

0000 /8  0                     0000 /0  0     0.0.0.0                28     0.1

IPM:  100    2800

The OPkts column displays the number of IP multicast (IPM) output packets, the OBytes column displays the number of IPM output bytes, and the DstIPaddress column displays the destination IP address for the IPM output packets.

In this example, both egress accounting and ingress accounting are enabled. The ingress ports are named Et1/1/1 and 1/1/2, and the egress ports are named Se2/1/1.16 and Et1/1/4.

Additional References

The following sections provide references related to the NetFlow Multicast Support feature.

Related Documents

Related Topic	Document Title
NetFlow	Cisco IOS Switching Services Configuration Guide Cisco IOS Switching Services Command Reference, Release 12.3 Cisco IOS Command Reference Master Index, Release 12.3
NetFlow version 9 data export	NetFlow v9 Export Format feature module, Release 12.3
NetFlow version 9 export format	NetFlow Version 9 Flow-Record Format white paper
Description of an actual customer deployment of NetFlow services within an IP network	NetFlow Services for an Enterprise Network integrated solutions document (ISD)
IP multicast routing	"IP Multicast" part in the Cisco IOS IP Configuration Guide, Release 12.2
NetFlow Minimum Prefix Mask For Router-Based Aggregation feature	NetFlow Minimum Prefix Mask for Router-Based Aggregation feature module, Release 12.1(3)T
NetFlow ToS-Based Router Aggregation feature	NetFlow ToS-Based Router Aggregation feature module, Release 12.1(3)T
Sampled NetFlow feature	Sampled NetFlow feature module, Release 12.0(26)S
NetFlow FlowCollector	NetFlow FlowCollector Installation and User Guide, Release 3.0 Release Notes for FlowCollector Release 3.0 and Release 3.0 (2.0)
NetFlow Data Analyzer	Network Data Analyzer Installation and User Guide, Release 3.0 Release Notes for Network Data Analyzer, Release 3.0

Standards

Standard	Title
None	—

MIBs

MIB	MIBs Link
None	To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs

RFCs

RFC	Title
None	—

Technical Assistance

Description	Link
The Cisco Technical Support website contains thousands of pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.	http://www.cisco.com/techsupport

Command Reference

This section documents modified commands only.

•ip multicast netflow

•ip multicast netflow rpf-failure

•show ip cache flow aggregation

•show ip cache verbose flow

ip multicast netflow

To configure multicast NetFlow accounting on an interface, use the ip multicast netflow command in interface configuration mode. To disable multicast NetFlow accounting, use the no form of this command.

ip multicast netflow {ingress | egress}

no ip multicast netflow {ingress | egress}

Syntax Description

ingress	Enables multicast NetFlow (ingress) accounting.
egress	Enables multicast NetFlow (egress) accounting.

Defaults

Multicast ingress NetFlow accounting is enabled.

Multicast egress NetFlow accounting is disabled.

Command Modes

Interface configuration

Command History

Release	Modification
12.3(1)	This command was introduced.
12.2(27)SBC	This command was integrated into Cisco IOS Release 12.2(27)SBC.
12.2(18)SXF	This command was integrated into Cisco IOS Release 12.2(18)SXF.

Usage Guidelines

You must have NetFlow accounting configured on your router before you can use this command.

ip multicast netflow ingress

NetFlow (ingress) accounting for multicast traffic is enabled by default. The ip multicast netflow ingress command does not appear in the configuration.

ip multicast netflow egress

You must enable multicast egress NetFlow accounting on all interfaces for which you want to count outgoing multicast streams.

Examples

The following example shows how to enable multicast ingress NetFlow accounting on the ingress Ethernet 1/0 interface:

Router(config)# interface ethernet 1/0

Router(config-if)# ip multicast netflow ingress

The following example shows how to enable multicast egress NetFlow accounting on the egress Ethernet interface 0/0:

Router(config)# interface ethernet 0/0

Router(config-if)# ip multicast netflow egress

Related Commands

Command	Description
ip multicast netflow rpf-failure	Enables accounting for multicast data that fails the RPF check.
show ip cache flow	Displays a summary of the NetFlow statistics.
show ip cache verbose flow	Displays a detailed summary of the NetFlow statistics.
show ip flow interface	Displays NetFlow accounting configuration for interfaces.
show ip mroute	Displays the contents of the IP multicast routing (mroute) table.

ip multicast netflow rpf-failure

To enable NetFlow accounting for multicast data that fails the reverse path forwarding (RPF) check (meaning any IP packets that lack a verifiable IP source address), use the ip multicast netflow rpf-failure command in global configuration mode. To disable accounting for multicast data that fails the RPF check, use the no form of this command.

ip multicast netflow rpf-failure

no ip multicast netflow rpf-failure

Syntax Description

This command has no arguments or keywords.

Defaults

Accounting for multicast data that fails the RPF check is disabled.

Command Modes

Global configuration

Command History

Release	Modification
12.3(1)	This command was introduced.
12.2(18)S	This command was integrated into Cisco IOS Release 12.2(18)S.
12.2(27)SBC	This command was integrated into Cisco IOS Release 12.2(27)SBC.
12.2(18)SXF	This command was integrated into Cisco IOS Release 12.2(18)SXF.

Usage Guidelines

You must have NetFlow accounting configured on your router before you can use this command.

Examples

The following example shows how to enable accounting for multicast data that fails the RPF check:

Router# configure terminal

Router(config)# ip multicast netflow rpf-failure

Router(config)# end

Related Commands

Command	Description
ip multicast netflow	Configures multicast NetFlow accounting on an interface.
show ip cache flow	Displays a summary of the NetFlow accounting statistics.
show ip cache verbose flow	Displays a detailed summary of the NetFlow accounting statistics.
show ip flow interface	Displays NetFlow accounting configuration for interfaces.
show ip mroute	Displays the contents of the IP multicast routing (mroute) table.
show ip rpf	Displays how IP multicast routing does RPF.
show ip rpf events	Displays the last 15 triggered multicast RPF check events.

show ip cache flow aggregation

To display the NetFlow accounting aggregation cache statistics, use the show ip cache flow aggregation command in user EXEC or privileged EXEC mode.

show ip cache [prefix mask] [type number] [verbose] flow aggregation {as | as-tos | bgp-nexthop-tos | destination-prefix | destination-prefix-tos | prefix | prefix-port | prefix-tos | protocol-port | protocol-port-tos | source-prefix | source-prefix-tos}

Syntax Description

prefix mask	(Optional) Displays only the entries in the cache that match the prefix and mask combination.
type number	(Optional) Displays only the entries in the cache that match the interface type and number combination.
verbose	(Optional) Displays additional information from the aggregation cache.
as	Displays the configuration of the autonomous system aggregation cache scheme.
as-tos	Displays the configuration of the autonomous system type of service (ToS) aggregation cache scheme.
bgp-nexthop-tos	Displays the configuration of BGP next hop and ToS aggregation cache scheme.
destination-prefix	Displays the configuration of the destination prefix aggregation cache scheme.
destination-prefix-tos	Displays the configuration of the destination prefix ToS aggregation cache scheme.
prefix	Displays the configuration of the prefix aggregation cache scheme.
prefix-port	Displays the configuration of the prefix port aggregation cache scheme.
prefix-tos	Displays the configuration of the prefix ToS aggregation cache scheme.
protocol-port	Displays the configuration of the protocol port aggregation cache scheme.
protocol-port-tos	Displays the configuration of the protocol port ToS aggregation cache scheme.
source-prefix	Displays the configuration of the source prefix aggregation cache scheme.
source-prefix-tos	Displays the configuration of the source prefix ToS aggregation cache scheme.

Command Modes

User EXEC
Privileged EXEC

Command History

Release	Modification
12.0(3)T	This command was introduced.
12.0(15)S	This command was modified to include new show output for ToS aggregation schemes.
12.2(14)S	This command was integrated into Cisco IOS Release 12.2(14)S.
12.3(1)	The bgp-nexthop-tos keyword was added.
12.2(18)S	The bgp-nexthop-tos aggregation cache keyword was added.
12.0(26)S	The bgp-nexthop-tos aggregation cache keyword was added.
12.2(27)SBC	This command was integrated into Cisco IOS Release 12.2(27)SBC.
12.2(18)SXF	This command was integrated into Cisco IOS Release 12.2(18)SXF.

Examples

The following is a sample display of an autonomous system aggregation cache with the show ip cache flow aggregation as command:

Router# show ip cache flow aggregation as

IP Flow Switching Cache, 278544 bytes

  2 active, 4094 inactive, 13 added

  178 ager polls, 0 flow alloc failures

Src If       Src AS  Dst If       Dst AS  Flows   Pkts  B/Pk  Active

Fa1/0         0      Null          0         1      2     49    10.2

Fa1/0         0      Se2/0         20        1      5    100     0.0

The following is a sample display of an autonomous system aggregation cache for the prefix mask 10.0.0.1 255.0.0.0 with the show ip cache flow aggregation as command:

Router# show ip cache 10.0.0.1 255.0.0.0 flow aggregation as

IP Flow Switching Cache, 278544 bytes

  2 active, 4094 inactive, 13 added

  178 ager polls, 0 flow alloc failures

Src If        Src AS  Dst If         Dst AS     Flows    Pkts  B/Pk  Active

e1/2           0      Null            0            1     2       49    10.2

e1/2           0      e1/2           20            1     5      100     0.0

The following is a sample display of an autonomous system aggregation cache for 10.0.0.1 255.0.0.0 Ethernet1/2 with the show ip cache verbose flow aggregation as command:

Router# show ip cache 10.0.0.1 255.0.0.0 e1/2 verbose flow aggregation as

IP Flow Switching Cache, 278544 bytes

  2 active, 4094 inactive, 13 added

  178 ager polls, 0 flow alloc failures

Src If        Src AS  Dst If         Dst AS     Flows    Pkts  B/Pk  Active

e1/2           0      Null            0            1     2       49    10.2

e1/2           0      e1/2           20            1     5      100     0.0

The following is a sample display of an autonomous system ToS aggregation cache with the show ip cache verbose flow aggregation as-tos command:

Router# show ip cache verbose flow aggregation as-tos

IP Flow Switching Cache, 278544 bytes

  4 active, 4092 inactive, 103 added

  1609 ager polls, 0 flow alloc failures

Src If         Src AS  Dst If         Dst AS  TOS Flows   Pkts  B/Pk  Active

Et1/2           50     Fd4/0           40     CC     1   3568     28    17.8

Et1/2           0      Fd4/0           40     C0    15     17K    28    17.8

Et1/1           50     Fd4/0           40     55     1   3748     28    17.8

Fd4/0           0      Null            0      C0     1      2     49     0.9

The following is a sample display of a protocol port ToS aggregation cache with the show ip cache verbose flow aggregation protocol-port-tos command:

Router# show ip cache verbose flow aggregation protocol-port-tos

IP Flow Switching Cache, 278544 bytes

  4 active, 4092 inactive, 102 added

  1584 ager polls, 0 flow alloc failures

Prot Src If        SrcPort  Dst If        DstPort TOS Flows  Pkts  B/Pk  Active

0x01 Et1/2           0000   Fd4/0           0000  C0    15    17K    28    17.8

0x01 Et1/2           0000   Fd4/0           0000  CC     1  3568     28    17.8

0x01 Et1/1           0000   Fd4/0           0000  55     1  3748     28    17.8

0x06 Fd4/0           00B3   Null            2AF9  C0     1     2     49     0.9

The following is a sample display of a source prefix ToS aggregation cache with the show ip cache verbose flow aggregation source-prefix-tos command:

Router# show ip cache verbose flow aggregation source-prefix-tos

IP Flow Switching Cache, 278544 bytes

  4 active, 4092 inactive, 105 added

  1683 ager polls, 0 flow alloc failures

Src If         Src Prefix      Msk  AS    TOS Flows  Pkts B/Pk  Active

Et1/1          52.0.0.0        /8   50    55     1  3748    28    17.8

Et1/2          52.0.0.0        /8   50    CC     1  3568    28    17.8

Et1/2          0.0.0.0         /0   0     C0    15    17K   28    17.8

Fd4/0          20.20.20.1      /32  0     C0     1     2    49     0.9

The following is a sample display of a destination prefix ToS aggregation cache with the show ip cache verbose flow aggregation destination-prefix-tos command:

Router# show ip cache verbose flow aggregation destination-prefix-tos

IP Flow Switching Cache, 278544 bytes

  4 active, 4092 inactive, 86 added

  1480 ager polls, 0 flow alloc failures

Dst If         Dst Prefix      Msk  AS    TOS Flows  Pkts B/Pk  Active

Local          10.31.31.1      /32  0     C0     1     2    49     0.9

Fd4/0          10.0.0.0        /8   40    55     1  3748    28    17.8

Fd4/0          10.0.0.0        /8   40    CC     1  3568    28    17.8

Fd4/0          10.0.0.0        /8   40    C0    15    17K   28    17.8

The following is a sample display of a prefix ToS aggregation cache with the show ip cache verbose flow aggregation prefix-tos command:

Router# show ip cache verbose flow aggregation prefix-tos

IP Flow Switching Cache, 278544 bytes

  4 active, 4092 inactive, 4 added

  14 ager polls, 0 flow alloc failures

Src If         Src Prefix      Dst If         Dst Prefix      TOS Flows    Pkts

               Msk AS                         Msk AS              B/Pk   Active

Et1/2          0.0.0.0         Fd4/0          10.0.0.0        C0    15    3933 

               /0  0                          /8  40                28     3.9

Et1/1          52.0.0.0        Fd4/0          42.0.0.0        55     1     826 

               /8  50                         /8  40                28     3.9

Et1/2          52.0.0.0        Fd4/0          42.0.0.0        CC     1     787 

               /8  50                         /8  40                28     3.9

The following is a sample display of a prefix port aggregation cache with the show ip cache verbose flow aggregation prefix-port command:

Router# show ip cache verbose flow aggregation prefix-port

IP Flow Switching Cache, 278544 bytes

  4 active, 4092 inactive, 105 added

  1679 ager polls, 0 flow alloc failures

Src If         Src Prefix      Dst If         Dst Prefix      TOS Flows    Pkts

               Port Msk                       Port Msk        Pr  B/Pk   Active

Fd4/0          10.20.20.1      Local          10.31.31.1      C0     1       2 

               00B3 /32                       2AF9 /32        06    49     0.9

Et1/2          0.0.0.0         Fd4/0          10.0.0.0        C0    15      17K

               0000 /0                        0000 /8         01    28    17.8

Et1/1          52.0.0.0        Fd4/0          42.0.0.0        55     1    3748 

               0000 /8                        0000 /8         01    28    17.8

Et1/2          52.0.0.0        Fd4/0          42.0.0.0        CC     1    3568 

               0000 /8                        0000 /8         01    28    17.8

Table 1 describes the significant fields shown in the output of the show ip cache verbose flow aggregation command.

Table 1 Field Descriptions for the show ip cache verbose flow aggregation Command 

Field	Description
bytes	Number of bytes of memory used by the NetFlow cache.
active	Number of active flows in the NetFlow cache at the time this command was entered.
inactive	Number of flow buffers that are allocated in the NetFlow cache, but are not currently assigned to a specific flow at the time this command is entered.
added	Number of flows created since the start of the summary period.
ager polls	Number of times the NetFlow code looked at the cache to cause entries to expire. (Used by Cisco for diagnostics only.)
flow alloc failures	Number of times the NetFlow code tried to allocate a flow but could not.
Src If	Specifies the source interface.
Src AS	Specifies the source autonomous system.
Dst If	Specifies the destination interface.
Dst AS	Specifies the destination autonomous system.
Flows	Number of flows.
Pkts	Number of packets.
B/Pk	Average number of bytes observed for the packets seen for this protocol (total bytes for this protocol or the total number of flows for this protocol for this summary period).
Active	Number of active flows in the NetFlow cache at the time this command was entered.

Related Commands

Command	Description
cache	Defines operational parameters for NetFlow accounting aggregation caches.
enabled (aggregation cache)	Enables a NetFlow accounting aggregation cache.
export destination (aggregation cache)	Enables the exporting of NetFlow accounting information from NetFlow aggregation caches.
ip flow-aggregation cache	Enables NetFlow accounting aggregation cache schemes.
mask (IPv4)	Specifies the source or destination prefix mask for a NetFlow accounting prefix aggregation cache.
show ip cache flow	Displays a summary of the NetFlow accounting statistics.
show ip cache verbose flow	Displays a detailed summary of the NetFlow accounting statistics.
show ip flow interface	Displays NetFlow accounting configuration for interfaces.

show ip cache verbose flow

To display a detailed summary of the NetFlow accounting statistics, use the show ip cache verbose flow command in user EXEC or privileged EXEC mode.

show ip cache verbose flow

Syntax Description

This command has no keywords or arguments.

Command Modes

User EXEC
Privileged EXEC

Command History

Release	Modification
11.1	This command was introduced.
11.1CA	The information display for the command was updated.
12.3(1)	The command output was updated to display additional NetFlow fields.
12.0(24)S	MPLS flow records were added to the command output.
12.3(4)T, 12.3(6), 12.2(20)S	The execute-on command was modified on the Cisco 7500 platforms to include the remote execution of the show ip cache verbose flow command.
12.3(8)T	MPLS flow records were added to the command output for Cisco IOS Release 12.3(8)T.
12.3(11)T	Support for egress flow accounting was added, and the [prefix mask] and [type number] arguments were removed.
12.3(14)T	Support for NetFlow Layer 2 and Security Monitoring Exports was added.
12.2(27)SBC	This command was integrated into Cisco IOS Release 12.2(27)SBC.
12.2(18)SXF.	This command was integrated into Cisco IOS Release 12.2(18)SXF.

Usage Guidelines

Use the show ip cache verbose flow command to display flow record fields in the NetFlow cache in addition to the fields that are displayed with the show ip cache flow command. The values in the additional fields that are shown depend on the NetFlow features that are enabled and the flags that are set in the flow.

---

Note The flags, and therefore the fields, might vary from flow to flow.

---

Some of the content in the display of the show ip cache verbose flow command uses multiline headings and multiline data fields. shows how to associate the headings with the correct data fields when there are two lines of headings and two lines of data fields. The first line of the headings is associated with the first line of data fields. The second line of the headings is associated with the second line of data fields.

When other features such as IP Multicast are configured, the number of lines in the headings and data fields increases. The method for associating the headings with the correct data fields remains the same.

Figure 1 How to Use the Multiline Headings and Multiline Data Fields in the Display Output from the show ip cache verbose flow Command

NetFlow Multicast Support

When the NetFlow Multicast Support feature is enabled, the show ip cache verbose flow command displays the number of replicated packets and the packet byte count for NetFlow multicast accounting. When you configure the NetFlow Version 9 Export Format feature, this command displays additional NetFlow fields in the header.

MPLS-aware NetFlow

When you configure the MPLS-aware NetFlow feature, you can use the show ip cache verbose flow command to display both the IP and MPLS portions of MPLS flows in the NetFlow cache on a router line card. To display only the IP portion of the flow record in the NetFlow cache when MPLS-aware NetFlow is configured, use the show ip cache flow command.

NetFlow BGP Nexthop

The NetFlow bgp-nexthop command can be configured when either the Version 5 export format or the Version 9 export format is configured. The following caveats apply to the bgp-nexthop command:

•The values for the BGP nexthop IP address are exported to a NetFlow collector only when the Version 9 export format is configured.

•In order for the BGP information to be populated in the main cache you must either have a NetFlow export destination configured or NetFlow aggregation configured.

Displaying Detailed NetFlow Cache Information on Platforms Running Distributed Cisco Express Forwarding

On platforms running Distributed Cisco Express Forwarding (dCEF), NetFlow cache information is maintained on each line card or Versatile Interface Processor. If you want to use the show ip cache verbose flow command to display this information on a distributed platform, you must enter the command at a line card prompt.

Cisco 7500 Series Platform

To display detailed NetFlow cache information on a Cisco 7500 series router that is running distributed dCEF, enter the following sequence of commands:

Router# if-con slot-number

LC-slot-number# show ip cache verbose flow 

For Cisco IOS Releases 12.3(4)T, 12.3(6), and 12.2(20)S and later, enter the following command to display detailed NetFlow cache information:

Router# execute-on slot-number show ip cache verbose flow 

Cisco 12000 Series Platform

To display detailed NetFlow cache information on a Cisco 12000 Series Internet Router, enter the following sequence of commands:

Router# attach slot-number

LC-slot-number# show ip cache verbose flow

For Cisco IOS Releases 12.3(4)T, 12.3(6), and 12.2(20)S and later, enter the following command to display detailed NetFlow cache information:

Router# execute-on slot-number show ip cache verbose flow 

Examples

The following example shows output from the show ip cache verbose flow command:

Router# show ip cache verbose flow

IP packet size distribution (25229 total packets):

   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480

   .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608

   .000 .000 .000 .206 .793 .000 .000 .000 .000 .000 .000

The preceding output shows the percentage distribution of packets by size. In this display, 20.6 percent of the packets fall in the 1024-byte size range and 79.3 percent fall in the 1536-byte range.

The next section of the output can be divided into three sections. The section and the table corresponding to each are as follows:

•Field Descriptions in the NetFlow Cache Section of the Output (Table 1 on page 17)

•Field Descriptions in the Activity by Protocol Section of the Output (Table 2)

•Field Descriptions in the NetFlow Record Section of the Output (Table 3)

IP Flow Switching Cache, 278544 bytes

  6 active, 4090 inactive, 17 added

  505 ager polls, 0 flow alloc failures

  Active flows timeout in 1 minutes

  Inactive flows timeout in 10 seconds

IP Sub Flow Cache, 25736 bytes

  12 active, 1012 inactive, 39 added, 17 added to flow

  0 alloc failures, 0 force free

  1 chunk, 1 chunk added

  last clearing of statistics never

Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)

--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow

TCP-Telnet           1      0.0       362   940      2.7      60.2       0.0

TCP-FTP              1      0.0       362   840      2.7      60.2       0.0

TCP-FTPD             1      0.0       362   840      2.7      60.1       0.1

TCP-SMTP             1      0.0       361  1040      2.7      60.0       0.1

UDP-other            5      0.0         1    66      0.0       1.0      10.6

ICMP                 2      0.0      8829  1378    135.8      60.7       0.0

Total:              11      0.0      1737  1343    147.0      33.4       4.8

SrcIf          SrcIPaddress    DstIf          DstIPaddress    Pr TOS Flgs  Pkts

Port Msk AS                    Port Msk AS    NextHop              B/Pk  Active

Et0/0.1        10.251.138.218  Et1/0.1        172.16.10.2     06 80  00      65 

0015 /0  0                     0015 /0  0     0.0.0.0               840    10.8

MAC: (VLAN id) aaaa.bbbb.cc03  (005)          aaaa.bbbb.cc06  (006)

Min plen:      840                            Max plen:       840

Min TTL:        59                            Max TTL:         59

IP id:           0

Et0/0.1        172.16.6.1      Et1/0.1        172.16.10.2     01 00  00    4880 

0000 /0  0                     0000 /0  0     0.0.0.0              1354    20.1

MAC: (VLAN id) aaaa.bbbb.cc03  (005)          aaaa.bbbb.cc06  (006)

Min plen:      772                            Max plen:       1500

Min TTL:       255                            Max TTL:        255

ICMP type:       0                            ICMP code:        0

IP id:        2943                            FO:            185

Et0/0.1        10.10.13.1      Et1/0.1        172.16.10.2     06 80  00      65 

0017 /0  0                     0017 /0  0     0.0.0.0               940    10.8

MAC: (VLAN id) aaaa.bbbb.cc03  (005)          aaaa.bbbb.cc06  (006)

Min plen:      940                            Max plen:       940

Min TTL:        59                            Max TTL:         59

IP id:           0

Et0/0.1        10.89.38.215    Et1/0.1        172.16.10.2     06 80  00      65 

0014 /0  0                     0014 /0  0     0.0.0.0               840    10.8

MAC: (VLAN id) aaaa.bbbb.cc03  (005)          aaaa.bbbb.cc06  (006)

Min plen:      840                            Max plen:       840

Min TTL:        59                            Max TTL:         59

IP id:           0

Et0/0.1        10.10.14.1      Et1/0.1        172.16.10.2     06 80  00      66 

0019 /0  0                     0019 /0  0     0.0.0.0              1040    11.0

MAC: (VLAN id) aaaa.bbbb.cc03  (005)          aaaa.bbbb.cc06  (006)

Min plen:      1040                            Max plen:       1040

Min TTL:        59                            Max TTL:         59

IP id:           0

Et0/0.1        172.16.6.1      Et1/0.1        172.16.10.2     01 00  10     975 

0000 /0  0                     0800 /0  0     0.0.0.0              1500    20.1

MAC: (VLAN id) aaaa.bbbb.cc03  (005)          aaaa.bbbb.cc06  (006)

Min plen:      15