Table Of Contents
Using Cisco IOS Flexible NetFlow Top N Talkers to Analyze Network Traffic
Prerequisites for Flexible NetFlow Top N Talkers
Information About Flexible NetFlow Top N Talkers
Flow Sorting and Top N Talkers
Documented Command Names and Actual Command Syntax
Combined Use of Flow Filtering, Flow Aggregation, and Flow Sorting with Top N Talkers
Memory and Performance Impact of Top N Talkers
How to Analyze Network Traffic With Cisco IOS Flexible NetFlow Top N Talkers
Filtering Flow Data from the Flexible NetFlow Cache
Aggregating Flow Data from the Flexible NetFlow Cache
Sorting Flow Data from the Flexible NetFlow Cache
Sorting Flow Data from the Flexible NetFlow Cache and Displaying the Top N Talkers
Examples for Flexible NetFlow Top N Talkers
Filtering Using Multiple Filtering Criterion: Example
Aggregation Using Multiple Aggregation Criterion: Example
Feature Information for Flexible NetFlow Top N Talkers
Using Cisco IOS Flexible NetFlow Top N Talkers to Analyze Network Traffic
First Published: October 10, 2008Last Updated: November 20, 2009This document contains information about and instructions for using the Flexible NetFlow—Top N Talkers Support feature. The Flexible NetFlow—Top N Talkers Support feature helps you analyze the large amount of data that Flexible NetFlow captures from the traffic in your network by providing the ability to filter, aggregate, and sort the data in the Flexible NetFlow cache as you display it. When you are sorting and displaying the data in the cache, you can limit the display output to a specific number of entries with the highest values (Top N Talkers) for traffic volume, packet counters, and so on. The Flexible NetFlow—Top N Talkers Support feature facilitates real-time traffic analysis by requiring only the use of show commands, which can be entered in many different variations using the available keywords and arguments to meet your traffic data analysis requirements.
NetFlow is a Cisco IOS technology that provides statistics on packets flowing through the router. NetFlow is the standard for acquiring IP operational data from IP networks. NetFlow provides network and security monitoring, network planning, traffic analysis, and IP accounting.
Flexible NetFlow improves on original NetFlow by adding the capability to customize the traffic analysis parameters for your specific requirements. Flexible NetFlow makes it easier to create more complex configurations for traffic analysis and data export through the use of reusable configuration components.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Flexible NetFlow Top N Talkers" section.
Use Cisco Feature Navigator to find information about platform support and Cisco IOS, Catalyst OS, and Cisco IOS XE software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
Prerequisites for Flexible NetFlow Top N Talkers
•
Information About Flexible NetFlow Top N Talkers
•
How to Analyze Network Traffic With Cisco IOS Flexible NetFlow Top N Talkers
•
Examples for Flexible NetFlow Top N Talkers
•
Feature Information for Flexible NetFlow Top N Talkers
Prerequisites for Flexible NetFlow Top N Talkers
The following prerequisites must be met before you can use the Flexible NetFlow—Top N Talkers Support feature:
•
You are familiar with the information in the "Cisco IOS Flexible NetFlow Overview" module.
•
The networking device is running a Cisco IOS release that supports the Flexible NetFlow—Top N Talkers Support feature. See the "Feature Information for Flexible NetFlow Top N Talkers" section for a list of Cisco IOS software releases that support Flexible NetFlow.
There are no configuration tasks associated with the Flexible NetFlow—Top N Talkers Support feature. Therefore, in order to use the Flexible NetFlow—Top N Talkers Support feature, traffic analysis with Flexible NetFlow must already be configured about the networking device. See the "Cisco IOS Flexible NetFlow Features Roadmap" module for information on configuring traffic analysis on your networking device with Flexible NetFlow.
Information About Flexible NetFlow Top N Talkers
Before you can use the Flexible NetFlow—Top N Talkers Support feature, you should understand the following concepts:
•
Flow Sorting and Top N Talkers
•
Documented Command Names and Actual Command Syntax
•
Combined Use of Flow Filtering, Flow Aggregation, and Flow Sorting with Top N Talkers
•
Memory and Performance Impact of Top N Talkers
Flow Filtering
The flow filtering function of the Flexible NetFlow—Top N Talkers Support feature filters the flow data in a flow monitor cache based on the criteria that you specify, and displays the data.
The flow filtering function of the Flexible NetFlow—Top N Talkers Support feature is provided by the show flow monitor cache filter command. For more information on the show flow monitor cache filter command, refer to the Cisco IOS Flexible NetFlow Command Reference.
Flow Aggregation
Flow aggregation using the show flow monitor cache aggregate command allows you to dynamically view the flow information in a cache using a different flow record than the cache was originally created from. Only the fields in the cache will be available for the aggregated flows.
The flow aggregation function of the Flexible NetFlow—Top N Talkers Support feature is provided by the show flow monitor cache aggregate command. For more information on the show flow monitor cache aggregate command, refer to the Cisco IOS Flexible NetFlow Command Reference.
Flow Sorting and Top N Talkers
The flow sorting function of the Flexible NetFlow—Top N Talkers Support feature sorts flow data from the Flexible NetFlow cache based on the criteria that you specify and displays the data. You can also use the flow sorting function of the Flexible NetFlow—Top N Talkers Support feature to limit the display output to a specific number of entries (top n talkers, where n is the number or talkers to display) by using the top keyword.
The flow sorting and Top N Talkers function of the Flexible NetFlow—Top N Talkers Support feature is provided by the show flow monitor cache sort command. For more information on the show flow monitor cache sort command, refer to the Cisco IOS Flexible NetFlow Command Reference.
Documented Command Names and Actual Command Syntax
The three commands that make up the Flexible NetFlow—Top N Talkers Support feature are documented using the Cisco documentation convention of using the initial words in the CLI syntax, omitting a subsequent words in the CLI syntax, and using a word in the CLI syntax that follows the omitted words. Therefore the syntax that you use for entering the commands is different from the actual documented command name. Table 1 shows the documented commands names and the actual command CLI syntax. The monitor-name argument is the name of a flow monitor that was previously configured.
Note
The arguments and keywords that you can use after filter, aggregation, and sort are not included in Table 1. For more information on the arguments and keywords that you can use after filter, aggregation, and sort, refer to the Cisco IOS Flexible NetFlow Command Reference.
Combined Use of Flow Filtering, Flow Aggregation, and Flow Sorting with Top N Talkers
Although each of the show commands that make up the Flexible NetFlow—Top N Talkers Support feature can be used individually for traffic analysis; they provide much greater analytical capabilities when they are used together. When you use any combination of the three show commands, you enter only the common prefix of show flow monitor monitor-name cache followed by filter, aggregation, sort, and the arguments and keywords available for filter, aggregation, sort, as required. For example,
show flow monitor monitor-name cache filter options aggregation options sort optionswhere options is any permissible combination of arguments and keywords. See the "Examples for Flexible NetFlow Top N Talkers" section for more information.
Memory and Performance Impact of Top N Talkers
The Flexible NetFlow—Top N Talkers Support feature can use a large number of CPU cycles and possibly also system memory for a short time. However, because Flexible NetFlow—Top N Talkers Support feature uses only show commands, the CPU usage should be run at a low priority because there is no real-time data processing involved. The memory usage can be mitigated by using a larger granularity of aggregation, or no aggregation at all.
How to Analyze Network Traffic With Cisco IOS Flexible NetFlow Top N Talkers
The tasks in this section are examples of using the Flexible NetFlow—Top N Talkers Support feature to analyze traffic in a network:
•
Filtering Flow Data from the Flexible NetFlow Cache
•
Aggregating Flow Data from the Flexible NetFlow Cache
•
Sorting Flow Data from the Flexible NetFlow Cache
•
Sorting Flow Data from the Flexible NetFlow Cache and Displaying the Top N Talkers
Filtering Flow Data from the Flexible NetFlow Cache
This task shows you how to use the show flow monitor cache filter command with a regular expression to filter the flow monitor cache data, and display the results. For more information on regular expressions and the show flow monitor cache filter command, refer to the Cisco IOS Flexible NetFlow Command Reference.
To filter the flow monitor cache data using a regular expression and display the results, perform the following task.
SUMMARY STEPS
1.
enable
2.
show flow monitor [name] monitor-name cache filter options [regexp regexp] [...options [regexp regexp] [format {csv | record | table}
DETAILED STEPS
Step 1
enable
Enters privileged EXEC mode.
Router> enableStep 2
show flow monitor [name] monitor-name cache filter options [regexp regexp] [...options [regexp regexp] [format {csv | record | table}
Filters the flow monitor cache data on the IPv4 type of service (ToS) value.
Router# show flow monitor FLOW-MONITOR-3 cache filter ipv4 tos regexp 0x(C0|50)Cache type: NormalCache size: 4096Current entries: 19High Watermark: 38Flows added: 3516Flows aged: 3497- Active timeout ( 1800 secs) 52- Inactive timeout ( 15 secs) 3445- Event aged 0- Watermark aged 0- Emergency aged 0IPV4 SOURCE ADDRESS: 10.1.1.1IPV4 DESTINATION ADDRESS: 255.255.255.255TRNS SOURCE PORT: 520TRNS DESTINATION PORT: 520INTERFACE INPUT: Et0/0FLOW SAMPLER ID: 0IP TOS: 0xC0IP PROTOCOL: 17ip source as: 0ip destination as: 0ipv4 next hop address: 0.0.0.0ipv4 source mask: /24ipv4 destination mask: /0tcp flags: 0x00interface output: Nullcounter bytes: 52counter packets: 1timestamp first: 18:59:46.199timestamp last: 18:59:46.199Matched 1 flow
Aggregating Flow Data from the Flexible NetFlow Cache
This task shows you how to use the show flow monitor cache aggregate command to aggregate the flow monitor cache data with a different record than the cache was created with, and display the results. For more information on the show flow monitor cache aggregate command, refer to the Cisco IOS Flexible NetFlow Command Reference.
To aggregate the flow monitor cache data and display the results, perform the following task.
SUMMARY STEPS
1.
enable
2.
show flow monitor [name] monitor-name cache aggregate {{options [...options] [collect options [...options]] | record record-name} [format {csv | record | table}}
DETAILED STEPS
Step 1
enable
Enters privileged EXEC mode.
Router> enableStep 2
show flow monitor [name] monitor-name cache aggregate {{options [...options] [collect options [...options]] | record record-name} [format {csv | record | table}}
Aggregates the flow monitor cache data on the IPv4 destination address and displays the cache data for the IPv4 protocol type and input interface non-key fields:
Router# show flow monitor FLOW-MONITOR-3 cache aggregate ipv4 destination address collect ipv4 protocol interface inputProcessed 17 flowsAggregated to 7 flowsIPV4 DST ADDR intf input flows bytes pkts ip prot=============== ==================== ========== ========== ========== =======224.192.16.4 Et0/0 3 42200 2110 1224.192.16.1 Et0/0 3 17160 858 1224.192.18.1 Et0/0 4 18180 909 1224.192.45.12 Et0/0 4 14440 722 1255.255.255.255 Et0/0 1 52 1 17224.0.0.13 Et0/0 1 54 1 103224.0.0.1 Et0/0 1 28 1 2
Sorting Flow Data from the Flexible NetFlow Cache
This task shows you how to use the show flow monitor cache sort command to sort the flow monitor cache data, and display the results. For more information on the show flow monitor cache sort command, refer to the Cisco IOS Flexible NetFlow Command Reference.
To sort the flow monitor cache data and display the results, perform the following task.
SUMMARY STEPS
1.
enable
2.
show flow monitor [name] monitor-name cache sort options [top [number]] [format {csv | record | table}]
DETAILED STEPS
Step 1
enable
Enters privileged EXEC mode.
Router> enableStep 2
show flow monitor [name] monitor-name cache sort options [top [number]] [format {csv | record | table}]
Displays the cache data sorted on the number of packets from highest to lowest.
Note
When the top keyword is not used, the default number of sorted flows shown is 20.
Router# show flow monitor FLOW-MONITOR-1 cache sort highest counter packetsProcessed 26 flowsAggregated to 26 flowsShowing the top 20 flowsIPV4 SOURCE ADDRESS: 10.1.1.3IPV4 DESTINATION ADDRESS: 172.16.10.11TRNS SOURCE PORT: 443TRNS DESTINATION PORT: 443INTERFACE INPUT: Et0/0.1FLOW SAMPLER ID: 0IP TOS: 0x00IP PROTOCOL: 6ip source as: 0ip destination as: 0ipv4 next hop address: 172.16.7.2ipv4 source mask: /0ipv4 destination mask: /24tcp flags: 0x00interface output: Et1/0.1counter bytes: 22760counter packets: 1569timestamp first: 19:42:32.924timestamp last: 19:57:28.656IPV4 SOURCE ADDRESS: 10.10.11.2IPV4 DESTINATION ADDRESS: 172.16.10.6TRNS SOURCE PORT: 65TRNS DESTINATION PORT: 65INTERFACE INPUT: Et0/0.1FLOW SAMPLER ID: 0IP TOS: 0x00IP PROTOCOL: 6ip source as: 0ip destination as: 0ipv4 next hop address: 172.16.7.2ipv4 source mask: /0ipv4 destination mask: /24tcp flags: 0x00interface output: Et1/0.1counter bytes: 22720counter packets: 568timestamp first: 19:42:34.264timestamp last: 19:57:28.428...IPV4 SOURCE ADDRESS: 192.168.67.6IPV4 DESTINATION ADDRESS: 172.16.10.200TRNS SOURCE PORT: 0TRNS DESTINATION PORT: 3073INTERFACE INPUT: Et0/0.1FLOW SAMPLER ID: 0IP TOS: 0x00IP PROTOCOL: 1ip source as: 0ip destination as: 0ipv4 next hop address: 172.16.7.2ipv4 source mask: /0ipv4 destination mask: /24tcp flags: 0x00interface output: Et1/0.1counter bytes: 15848counter packets: 344timestamp first: 19:42:36.852timestamp last: 19:57:27.836IPV4 SOURCE ADDRESS: 10.234.53.1IPV4 DESTINATION ADDRESS: 172.16.10.2TRNS SOURCE PORT: 0TRNS DESTINATION PORT: 2048INTERFACE INPUT: Et0/0.1FLOW SAMPLER ID: 0IP TOS: 0x00IP PROTOCOL: 1ip source as: 0ip destination as: 0ipv4 next hop address: 172.16.7.2ipv4 source mask: /0ipv4 destination mask: /24tcp flags: 0x00interface output: Et1/0.1counter bytes: 15848counter packets: 213timestamp first: 19:42:36.904timestamp last: 19:57:27.888
Sorting Flow Data from the Flexible NetFlow Cache and Displaying the Top N Talkers
This task shows you how to use the show flow monitor cache sort command to sort the flow monitor cache data, and to limit the display results to a specific number of high volume flows. For more information on the show flow monitor cache sort command, refer to the Cisco IOS Flexible NetFlow Command Reference.
To sort the flow monitor cache data and limit the display output using to a specific number of high volume flows, perform the following task:
SUMMARY STEPS
1.
enable
2.
show flow monitor [name] monitor-name cache sort options [top [number]] [format {csv | record | table}]
DETAILED STEPS
Step 1
enable
Enters privileged EXEC mode.
Router> enableStep 2
show flow monitor [name] monitor-name cache sort options [top [number]] [format {csv | record | table}]
Displays the cache data sorted on the number of packets from highest to lowest and limits the output to the three highest volume flows:
Router# show flow monitor FLOW-MONITOR-1 cache sort highest counter packets top 3Processed 25 flowsAggregated to 25 flowsShowing the top 3 flowsIPV4 SOURCE ADDRESS: 10.1.1.3IPV4 DESTINATION ADDRESS: 172.16.10.11TRNS SOURCE PORT: 443TRNS DESTINATION PORT: 443INTERFACE INPUT: Et0/0.1FLOW SAMPLER ID: 0IP TOS: 0x00IP PROTOCOL: 6ip source as: 0ip destination as: 0ipv4 next hop address: 172.16.7.2ipv4 source mask: /0ipv4 destination mask: /24tcp flags: 0x00interface output: Et1/0.1counter bytes: 32360counter packets: 1897timestamp first: 19:42:32.924timestamp last: 20:03:47.100IPV4 SOURCE ADDRESS: 10.10.11.2IPV4 DESTINATION ADDRESS: 172.16.10.6TRNS SOURCE PORT: 65TRNS DESTINATION PORT: 65INTERFACE INPUT: Et0/0.1FLOW SAMPLER ID: 0IP TOS: 0x00IP PROTOCOL: 6ip source as: 0ip destination as: 0ipv4 next hop address: 172.16.7.2ipv4 source mask: /0ipv4 destination mask: /24tcp flags: 0x00interface output: Et1/0.1counter bytes: 32360counter packets: 809timestamp first: 19:42:34.264timestamp last: 20:03:48.460IPV4 SOURCE ADDRESS: 172.16.1.84IPV4 DESTINATION ADDRESS: 172.16.10.19TRNS SOURCE PORT: 80TRNS DESTINATION PORT: 80INTERFACE INPUT: Et0/0.1FLOW SAMPLER ID: 0IP TOS: 0x00IP PROTOCOL: 6ip source as: 0ip destination as: 0ipv4 next hop address: 172.16.7.2ipv4 source mask: /24ipv4 destination mask: /24tcp flags: 0x00interface output: Et1/0.1counter bytes: 32320counter packets: 345timestamp first: 19:42:34.512timestamp last: 20:03:47.140
Examples for Flexible NetFlow Top N Talkers
This section contains the following example:
•
Filtering Using Multiple Filtering Criterion: Example
•
Aggregation Using Multiple Aggregation Criterion: Example
Filtering, Aggregating, and Sorting Flow Data from the Flexible NetFlow Cache and Displaying the Top Talkers: Example
The following example combines filtering, aggregation, collecting additional field data, sorting the flow monitor cache data, and limiting the display output to a specific number of high volume flows (top talkers).
This sample runs in privileged EXEC mode:
Router# show flow monitor FLOW-MONITOR-1 cache filter ipv4 protocol regexp (1|6) aggregate ipv4 destination address collect ipv4 protocol sort counter bytes top 4Processed 26 flowsMatched 26 flowsAggregated to 13 flowsShowing the top 4 flowsIPV4 DST ADDR flows bytes pkts=============== ========== ========== ==========172.16.10.2 12 1358370 6708172.16.10.19 2 44640 1116172.16.10.20 2 44640 1116172.16.10.4 1 22360 559The following example combines filtering using a regular expression, aggregation using a predefined record, sorting the flow monitor cache data, limiting the display output to a specific number of high volume flows (top talkers), and displaying the output in record format.
This sample runs in privileged exec mode:
Router# show flow monitor FLOW-MONITOR-1 cache filter ipv4 source address regexp 10.* aggregate record netflow ipv4 protocol-port sort transport destination-port top 5 format recordProcessed 26 flowsMatched 15 flowsAggregated to 10 flowsShowing the top 5 flowsTRNS SOURCE PORT: 0TRNS DESTINATION PORT: 0FLOW DIRECTION: InputIP PROTOCOL: 1counter flows: 1counter bytes: 387800counter packets: 700timestamp first: 17:12:30.712timestamp last: 17:30:52.936TRNS SOURCE PORT: 20TRNS DESTINATION PORT: 20FLOW DIRECTION: InputIP PROTOCOL: 6counter flows: 2counter bytes: 56000counter packets: 1400timestamp first: 17:12:29.532timestamp last: 17:30:53.148TRNS SOURCE PORT: 21TRNS DESTINATION PORT: 21FLOW DIRECTION: InputIP PROTOCOL: 6counter flows: 2counter bytes: 56000counter packets: 1400timestamp first: 17:12:29.572timestamp last: 17:30:53.196TRNS SOURCE PORT: 22TRNS DESTINATION PORT: 22FLOW DIRECTION: InputIP PROTOCOL: 6counter flows: 1counter bytes: 28000counter packets: 700timestamp first: 17:12:29.912timestamp last: 17:30:52.168TRNS SOURCE PORT: 25TRNS DESTINATION PORT: 25FLOW DIRECTION: InputIP PROTOCOL: 6counter flows: 2counter bytes: 56000counter packets: 1400timestamp first: 17:12:29.692timestamp last: 17:30:51.968Filtering Using Multiple Filtering Criterion: Example
The following example filters the cache data on the IPv4 destination address and the destination port:
This sample runs in privileged exec mode:
Router# show flow monitor FLOW-MONITOR-1 cache filter ipv4 destination address regexp 172.16.10* transport destination-port 21Cache type: NormalCache size: 4096Current entries: 26High Watermark: 26Flows added: 241Flows aged: 215- Active timeout ( 1800 secs) 50- Inactive timeout ( 15 secs) 165- Event aged 0- Watermark aged 0- Emergency aged 0IPV4 SOURCE ADDRESS: 10.10.10.2IPV4 DESTINATION ADDRESS: 172.16.10.2TRNS SOURCE PORT: 21TRNS DESTINATION PORT: 21INTERFACE INPUT: Et0/0.1FLOW SAMPLER ID: 0IP TOS: 0x00IP PROTOCOL: 6ip source as: 0ip destination as: 0ipv4 next hop address: 172.16.7.2ipv4 source mask: /0ipv4 destination mask: /24tcp flags: 0x00interface output: Et1/0.1counter bytes: 17200counter packets: 430timestamp first: 17:03:58.071timestamp last: 17:15:14.615IPV4 SOURCE ADDRESS: 172.30.231.193IPV4 DESTINATION ADDRESS: 172.16.10.2TRNS SOURCE PORT: 21TRNS DESTINATION PORT: 21INTERFACE INPUT: Et0/0.1FLOW SAMPLER ID: 0IP TOS: 0x00IP PROTOCOL: 6ip source as: 0ip destination as: 0ipv4 next hop address: 172.16.7.2ipv4 source mask: /0ipv4 destination mask: /24tcp flags: 0x00interface output: Et1/0.1counter bytes: 17160counter packets: 429timestamp first: 17:03:59.963timestamp last: 17:15:14.887Matched 2 flowsAggregation Using Multiple Aggregation Criterion: Example
The following example aggregates the flow monitor cache data on the destination and source IPv4 addresses:
This sample runs in privileged exec mode:
Router# show flow monitor FLOW-MONITOR-1 cache aggregate ipv4 destination address ipv4 source addressProcessed 26 flowsAggregated to 17 flowsIPV4 SRC ADDR IPV4 DST ADDR flows bytes pkts=============== =============== ========== ========== ==========10.251.10.1 172.16.10.2 2 1400828 1364192.168.67.6 172.16.10.200 1 19096 68210.234.53.1 172.16.10.2 3 73656 2046172.30.231.193 172.16.10.2 3 73616 204510.10.10.2 172.16.10.2 2 54560 1364192.168.87.200 172.16.10.2 2 54560 136410.10.10.4 172.16.10.4 1 27280 68210.10.11.1 172.16.10.5 1 27280 68210.10.11.2 172.16.10.6 1 27280 68210.10.11.3 172.16.10.7 1 27280 68210.10.11.4 172.16.10.8 1 27280 68210.1.1.1 172.16.10.9 1 27280 68210.1.1.2 172.16.10.10 1 27280 68210.1.1.3 172.16.10.11 1 27280 682172.16.1.84 172.16.10.19 2 54520 1363172.16.1.85 172.16.10.20 2 54520 1363172.16.6.1 224.0.0.9 1 52 1Router#Additional References
The following sections provide references related to the Flexible NetFlow—Top N Talkers Support feature.
Related Documents
Related Topic Document TitleCisco IOS commands
Overview of Flexible NetFlow
Flexible NetFlow Feature Roadmap
Configuring flow exporters to export Flexible NetFlow data
"Configuring Data Export for Cisco IOS Flexible NetFlow with Flow Exporters"
Customizing Flexible NetFlow
"Customizing Cisco IOS Flexible NetFlow Flow Records and Flow Monitors"
Configuring flow sampling to reduce the overhead of monitoring traffic with Flexible NetFlow
"Using Cisco IOS Flexible NetFlow Flow Sampling to Reduce the CPU Overhead of Analyzing Traffic"
Configuring Flexible NetFlow using predefined records
"Configuring Cisco IOS Flexible NetFlow with Predefined Records"
Configuring IPv4 Multicast Statistics Support for Flexible NetFlow
"Configuring IPv4 Multicast Statistics Support for Cisco IOS Flexible NetFlow"
Configuration commands for Flexible NetFlow
Standards
MIBs
MIB MIBs LinkNone
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
Technical Assistance
Feature Information for Flexible NetFlow Top N Talkers
Table 2 lists the features in this module and provides links to specific configuration information. Only features that were introduced or modified in Cisco IOS Release 12.2(1) or Cisco IOS Releases 12.2(1) or 12.0(3)S or a later release appear in the table.
For information on a feature in this technology that is not documented here, see the "Cisco IOS Flexible NetFlow Features Roadmap".
Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS, Catalyst OS, and Cisco IOS XE software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note
Table 2 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.
Table 2 Feature Information for Flexible NetFlow
Feature Name Releases Feature Usage InformationFlexible NetFlow—Top N Talkers Support
12.4(22)T 12.2(33)SRE
Helps you analyze the large amount of data Flexible NetFlow captures from the traffic in your network by providing the ability to filter, aggregate, and sort the data in the Flexible NetFlow cache as you display it.
Support for this feature was added for Cisco 7200 and 7300 NPE series routers in Cisco IOS Release 12.2(33)SRE.
Information about the Flexible NetFlow—Top N Talkers Support feature is included in the following sections:
•
Prerequisites for Flexible NetFlow Top N Talkers
•
Information About Flexible NetFlow Top N Talkers
•
How to Analyze Network Traffic With Cisco IOS Flexible NetFlow Top N Talkers
•
Examples for Flexible NetFlow Top N Talkers
The following commands were introduced or modified:
show flow monitor cache aggregate, show flow monitor cache filter, show flow monitor cache sort.
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0910R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2008-2009 Cisco Systems, Inc. All rights reserved.

