Table Of Contents

mls exclude protocol

mls flow

mls ip

mls ip cef arp-throttling

mls ip cef load-sharing full

mls ip cef rate-limit

mls ip directed-broadcast

mls ip inspect

mls ip multicast (global configuration mode)

mls ip multicast (interface configuration mode)

mls ip multicast connected

mls ip multicast consistency-check

mls ip multicast non-rpf-netflow (global configuration mode)

mls ip multicast non-rpf-netflow (interface configuration mode)

mls ip multicast stub

mls ip multicast threshold

mls ip pbr

mls ipx (interface configuration mode)

mls nde flow

mls nde interface

mls nde sender

mls nde src_address

mls netflow

mls netflow maximum-flows

mls netflow sampling

mls netflow usage notify

mls qos (global configuration mode)

mls qos (interface configuration mode)

mls qos aggregate-policer

mls qos bridged

mls qos channel-consistency

mls qos cos

mls qos flow-policing

mls qos map cos-dscp

mls qos map dscp-cos

mls qos map ip-prec-dscp

mls qos map policed-dscp

mls qos queueing-only

mls qos statistics-export (global configuration mode)

mls qos statistics-export (interface configuration mode)

mls qos statistics-export aggregate-policer

mls qos statistics-export class-map

mls qos statistics-export delimiter

mls qos statistics-export destination

mls qos statistics-export interval

mls qos trust

mls qos trust extend

mls qos vlan-based

mls rp ip (global configuration mode)

mls rp ip (interface configuration mode)

mls rp ipx (global configuration mode)

mls rp ipx (interface configuration mode)

mls rp management-interface

mls rp nde-address

mls rp vlan-id

mls rp vtp-domain

mls sampling

mode

monitor session

mpls l2transport route

mpls load-balance per-label

mtu

name

net

pagp learn-method

pagp port-priority

22

mls exclude protocol

To specify the interface protocol to exclude from shortcutting, use the mls exclude protocol command. Use the no form of this command to remove a prior entry.

mls exclude protocol {{both | tcp | udp}{port port-number}}

no mls exclude

Syntax Description

both	Specifies both UDP and TCP.
tcp	Excludes TCP interfaces from shortcutting.
udp	Specifies UDP interfaces from shortcutting.
port port-number	Specifies the port number; valid values are from 1 to 65535.

Defaults

This command has no default settings.

Command Modes

Global configuration

Command History

Release	Modification
12.0(7)XE	Support for this command was introduced on the Catalyst 6500 series switches.
12.1(1)E	Support for this command on the Catalyst 6500 series switches was extended to the 12.1 E release.

Examples

This example shows how to configure MLS to exclude UDP on port 69:

Router(config)# mls exclude protocol udp port 69

Router(config)#

Related Commands

show mls ip multicast
show mls ipx

mls flow

To configure the NDE flow mask, use the mls flow command. This command collects statistics for the supervisor engine. Use the no form of this command to restore the flow mask to the default settings.

mls flow {ip {destination | destination-source | full | interface-destination-source | interface-full | source-only}}

mls flow {ipx {destination | destination-source}}

no mls flow {ip | ipx}

Syntax Description

ip	Enables the flow mask for MLS IP packets.
destination	Uses the destination IP address as the key to the Layer 3 table.
destination-source	Uses the destination and the source IP address as the key to the Layer 3 table.
full	Uses the source and destination IP address, the IP protocol (UDP or TCP), and the source and destination port numbers as the keys to the Layer 3 table.
interface-destination-source	Uses all the information in the destination and source flow mask and the source VLAN number as the keys to the Layer 3 table.
source-only	Uses all the information in the source flow mask only.
interface-full	Uses all the information in the full flow mask and the source VLAN number as the keys to the Layer 3 table.
ipx	Enables the flow mask for MLS IPX packets.

Defaults

The minimum (least specific) flow mask is the default. In systems configured with a Supervisor Engine 2, the minimum flow mask is destination.

Command Modes

Global configuration

Command History

Release	Modification
12.0(7)XE	Support for this command was introduced on the Catalyst 6500 series switches.
12.1(1)E	Support for this command on the Catalyst 6500 series switches was extended to the 12.1 E release.
12.1(13)E	This command was changed to add the interface-destination-source and interface-full options.

Examples

This example shows how to set the minimum flow mask for an extended access list for MLS IP:

Router(config)# mls flow ip full

Router(config)#

Related Commands

show mls netflow

mls ip

To enable MLS IP for the internal router on the interface, use the mls ip command. Use the no form of this command to disable MLS IP on the interface.

mls ip

no mls ip

Syntax Description

This command has no arguments or keywords.

Defaults

Multicast is disabled.

Command Modes

Interface configuration

Command History

Release	Modification
12.0(7)XE	Support for this command was introduced on the Catalyst 6500 series switches.
12.1(1)E	Support for this command on the Catalyst 6500 series switches was extended to the 12.1 E release.
12.1(12c)E	Support for this command was introduced on the Catalyst 6500 series switch Supervisor Engine 2.

Examples

This example shows how to enable MLS IP shortcuts:

Router(config-if)# mls ip 

Router(config-if)# 

Related Commands

mls rp ip (interface configuration mode)
show mls ip multicast

mls ip cef arp-throttling

To enable per-destination based rate limiting of packets requiring ARP resolution, use the mls ip cef arp-throttling command. Use the no form of this command to disable ARP throttling.

mls ip cef arp-throttling

no mls ip cef arp-throttling

Syntax Description

This command has no arguments or keywords.

Defaults

Enabled

Command Modes

Global configuration

Command History

Release	Modification
12.1(19)E1	Support for this command was introduced on the Catalyst 6500 series switches.

Usage Guidelines

ARP throttling limits the rate at which packets destined to a connected network are forwarded to the route processor. Most of these packets are dropped, but a small number are sent to the router (rate limited).

Examples

This example shows how to enable per-destination based rate limiting of packets requiring ARP resolution:

Router(config)# mls ip cef arp-throttling

Router(config)#

This example shows how to disable per-destination based rate limiting of packets requiring ARP resolution:

Router(config)# no mls ip cef arp-throttling

Router(config)#

mls ip cef load-sharing full

To set CEF load balancing to include Layer 4 ports and source IP/destination IP addresses (Layer 3), use the mls ip cef load-sharing full command. Use the no form of this command to return to the default settings.

mls ip cef load-sharing full

no mls ip cef load-sharing full

Syntax Description

This command has no arguments or keywords.

Defaults

Load balancing is based on the source IP/destination IP addresses only.

Command Modes

Global configuration

Command History

Release	Modification
12.1(11b)E	Support for this command was introduced on the Supervisor Engine 2.

Usage Guidelines

The mls ip cef load-sharing full command is supported on systems configured with the Supervisor Engine 2 only.

For additional guidelines, refer to the Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide.

Examples

This example shows how to set load balancing to include Layer 3 and Layer 4 ports:

Router(config)# mls ip cef load-sharing full

Router(config)#

This example shows how to return to the default settings:

Router(config)# no mls ip cef load-sharing full

Router(config)#

Related Commands

show running-config

mls ip cef rate-limit

To rate limit CEF-punted data packets, use the mls ip cef rate-limit command. Use the no form of this command to disable this feature.

mls ip cef rate-limit pps

no mls ip cef rate-limit

Syntax Description

pps	Number of data packets; valid values are from 0 to 1000000.

Defaults

No rate limit is configured.

Command Modes

Global configuration

Command History

Release	Modification
12.1(5c)EX	Support for this command was introduced on the Supervisor Engine 2.
12.1(8a)E	Support for this command on the Supervisor Engine 2 was extended to the 12.1 E release.

Usage Guidelines

The mls ip cef rate-limit command is supported on systems configured with the Supervisor Engine 2 only.

Certain denial-of-service attacks target the route processing engines of routers. Certain packets that cannot be forwarded by the PFC2 are directed to the MSFC2 for processing. Denial-of-service attacks can overload the route processing engine and cause routing instability when running dynamic routing protocols. The mls ip cef rate-limit command can be used to limit the amount of traffic sent to the MSFC2 to prevent denial-of-service attacks against the route processing engine.

This command rate limits all CEF-punted data packets including the following:

•Data packets going to the local interface IP address

•Data packets requiring ARP

Setting the rate to a low value could impact handling of packets destined to the IP addresses of the local interfaces and packets requiring ARP.

You should use this command to limit these packets to a normal rate and to avoid abnormal incoming rates.

For additional guidelines, refer to the Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide.

Examples

This example shows how to enable and set the rate-limiting feature:

Router(config)# mls ip cef rate-limit 50000

Router(config)# 

mls ip directed-broadcast

To enable hardware switching of IP-directed broadcasts, use the mls ip directed-broadcast command. Use the no form of this command to return to the default settings.

mls ip directed-broadcast {exclude-router | include-router}

no mls ip directed-broadcast

Syntax Description

exclude-router	Forwards the IP-directed broadcast packet in hardware to all hosts in the VLAN except the router.
include-router	Forwards the IP-directed broadcast packet in hardware to all hosts in the VLAN including the router.

Defaults

Hardware switching of IP-directed broadcasts is disabled.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(11b)E	Support for this command was introduced on the Catalyst 6500 series switches.

Usage Guidelines

This command is supported in Catalyst 6500 series switches configured with a Supervisor Engine 2 with a Layer 3 Switching Engine II (PFC2) only.

You must configure jumbo-frame support to support fragmented traffic with directed broadcasts by performing one of the following:

•Enter the mtu command on the IP-directed broadcast interface if jumbo frames are required.

•Enter the mls ip directed-broadcast include-router command to forward the IP-directed broadcast packet in hardware to all hosts in the VLAN including the router.

The exclude-router and include-router keywords both support hardware switching, but exclude-router does not send a copy of the hardware-switched packets to the router. If you enter the include-router keyword, the router does not forward the IP-directed broadcast packet again.

In the default mode, IP-directed broadcast packets are not hardware forwarded; they are handled at the process level by the MSFC2. The MSFC2 decision to forward or not forward the packet is then dependent on the ip directed-broadcast command configuration.

There is no interaction between the ip directed-broadcast command and the mls ip directed-broadcast command. The ip directed-broadcast command involves software forwarding and the mls ip directed-broadcast command involves hardware forwarding.

MLS IP-directed broadcast supports secondary IP addresses of interfaces.

Any packets that hit the CPU are not forwarded unless you add the ip directed-broadcast command to the same interface.

You can configure MLS IP-directed broadcasts on a port-channel interface but not on the physical interfaces on the port-channel interface. If you want to add a physical interface to a port-channel group, the physical interface cannot have the MLS IP-directed broadcast configuration. You have to first remove the configuration manually and then you can add the physical interface to the channel group. If a physical interface is already part of a channel-group, the CLI will not accept the mls ip directed-broadcast configuration command on that physical interface.

Examples

This example shows how to forward the IP-directed broadcast packet in hardware to all hosts in the VLAN with the exception of the router:

Router(config-if)# mls ip directed-broadcast exclude-router

Router(config-if)# 

This example shows how to forward the IP-directed broadcast packet in hardware to all hosts in the VLAN:

Router(config-if)# mls ip directed-broadcast include-router

Router(config-if)# 

Related Commands

mls ip directed-broadcast (refer to the Cisco IOS Release 12.1 Command Reference)
mtu
show mls cef adjacency

mls ip inspect

To permit traffic through any ACLs that would deny the traffic through other interfaces, use the mls ip inspect command. Use the no form of this command to return to the default settings.

mls ip inspect acl-name

no mls ip inspect acl-name

Syntax Description

acl-name

ACL name.

Defaults

Disabled

Command Modes

Global configuration

Command History

Release	Modification
12.1(6)E	Support for this command was introduced on the Catalyst 6500 series switches.

Usage Guidelines

On a Catalyst 6500 series switch, when interfaces are configured to deny traffic, the CBAC permits traffic to flow bidirectionally only through the interface that is configured with the ip inspect command.

Examples

This example shows how to permit the traffic through a specific ACL (named deny_ftp_c):

Router(config)# mls ip inspect deny_ftp_c 

Router(config)# 

Usage Guidelines

ip inspect (refer to the Cisco IOS Release 12.1 Command Reference)

mls ip multicast (global configuration mode)

To globally enable MLS IP on the Catalyst 6500 series switch, use the mls ip multicast command. Use the no form of this command to disable MLS IP on the Catalyst 6500 series switch.

mls ip multicast

no mls ip multicast

Syntax Description

This command has no arguments or keywords.

Defaults

Multicast is disabled.

Command Modes

Global configuration

Command History

Release	Modification
12.0(7)XE	Support for this command was introduced on the Catalyst 6500 series switches.
12.1(1)E	Support for this command on the Catalyst 6500 series switches was extended to the 12.1 E release.

Examples

This example shows how to enable MLS IP shortcuts:

Router(config)# mls ip multicast

Router(config)# 

Related Commands

mls rp ip (global configuration mode)
show mls ip multicast

mls ip multicast (interface configuration mode)

To enable MLS IP shortcuts on the interface, use the mls ip multicast command. Use the no form of this command to disable MLS IP shortcuts on the interface.

mls ip multicast

no mls ip multicast

Syntax Description

This command has no arguments or keywords.

Defaults

Multicast is disabled.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(5c)EX	Support for this command was introduced on the Supervisor Engine 2.
12.1(8a)E	Support for this command on the Supervisor Engine 2 was extended to the 12.1 E release.
12.1(19)E1	Support for this command was extended to the FlexWAN module ATM subinterfaces

Examples

This example shows how to enable MLS IP shortcuts:

Router(config-if)# mls ip multicast

Router(config-if)# 

Related Commands

show mls ip multicast

mls ip multicast connected

To globally enable the downloading of directly connected subnets, use the mls ip multicast connected command. Use the no form of this command to disable the feature.

mls ip multicast connected

no mls ip multicast connected

Syntax Description

This command has no arguments or keywords.

Defaults

Multicast is disabled.

Command Modes

Global configuration

Command History

Release	Modification
12.1(5c)EX	Support for this command was introduced on the Supervisor Engine 2.
12.1(8a)E	Support for this command on the Supervisor Engine 2 was extended to the 12.1 E release.

Usage Guidelines

The mls ip multicast connected command is supported on systems configured with the Supervisor Engine 2 only.

Examples

This example shows how to enable the downloading of directly connected subnets:

Router(config)# mls ip multicast connected

Router(config)# 

Related Commands

mls ip multicast (global configuration mode)
show mls ip multicast

mls ip multicast consistency-check

To enable and configure the hardware shortcut consistency checker, use the mls ip multicast consistency-check command. Use the no form of this command to disable the consistency checkers.

mls ip multicast consistency-check [{settle-time seconds} | {type scan-mroute [count count-number] | {settle-time seconds}} | {period seconds}]

no mls ip multicast consistency-check

Syntax Description

settle-time seconds	(Optional) Specifies the settle time for entry/oif for the consistency checker; valid values are from 2 to 3600 seconds.
type scan-mroute	(Optional) Specifies the type of consistency check as a scan check of the mroute table.
count count-number	(Optional) Specifies the maximum number of prefixes to check per scan; valid values are from 2 to 500.
period seconds	Specifies the period between scans; valid values are from 2 to 3600 seconds.

Defaults

The defaults are as follows:

•Consistency check is enabled.

•count count-number is 20.

•period seconds is 2 seconds.

•settle-time seconds is 60 seconds.

Command Modes

Global configuration

Command History

Release	Modification
12.1(12c)E4	Support for this command was introduced on the Supervisor Engine 2.

Usage Guidelines

oif is the outgoing interface of a multicast {*,G} or {source, group} flow.

The consistency checker scans the mroute-table and assures that the multicast-hardware entries are consistent with the mroute-table. Whenever an inconsistency is detected, the inconsistency is automatically corrected.

To display the inconsistency error, use the show mls ip multicast consistency-check command.

Examples

This example shows how to enable the hardware shortcut consistency checker:

Router (config)# mls ip multicast consistency-check

Router (config)# 

This example shows how to enable the hardware shortcut consistency checker and configure the scan check of the mroute table:

Router (config)# mls ip multicast consistency-check type scan-mroute count 20 period 35

Router (config)# 

This example shows how to enable the hardware shortcut consistency checker and specify the period between scans:

Router (config)# mls ip multicast consistency-check type scan-mroute period 35

Router (config)# 

Related Commands

show mls ip multicast consistency-check

mls ip multicast non-rpf-netflow (global configuration mode)

To enable the NetFlow-based non-RPF feature, use the mls ip multicast non-rpf-netflow command. Use the no form of this command to disable the feature.

mls ip multicast non-rpf-netflow

no mls ip multicast non-rpf-netflow

Syntax Description

This command has no arguments or keywords.

Defaults

Multicast is disabled.

Command Modes

Global configuration

Command History

Release	Modification
12.1(5c)EX	Support for this command was introduced on the Supervisor Engine 2.
12.1(8a)E	Support for this command on the Supervisor Engine 2 was extended to the 12.1 E release.

Usage Guidelines

An RPF interface is used if a unicast packet is sent back to the source.

If a multicast packet encounters an RPF MFD shortcut, it is not sent to the route processor on the MSFC. The router processor never sees a copy of the packet forwarded by the hardware. The RPF MFDs are installed to switch packets arriving on the RPF interface.

A non-RPF MFD is an MFD that is installed to switch packets on the non-RPF VLAN. With RPF MFDs, the packets arriving on the RPF VLAN are forwarded to the outgoing VLANs. With non-RPF MFDs, the packets are bridged only on the VLAN on which it was received. The packet is not sent to the MSFC.

Examples

This example shows how to enable the NetFlow-based non-RPF feature:

Router(config)# mls ip multicast non-rpf-netflow

Router(config)# 

Related Commands

mls ip multicast non-rpf-netflow (interface configuration mode)
show mls ip multicast

mls ip multicast non-rpf-netflow (interface configuration mode)

To enable the NetFlow-based non-RPF feature on a specific interface, use the mls ip multicast non-rpf-netflow command. Use the no form of this command to disable the feature.

mls ip multicast non-rpf-netflow

no mls ip multicast non-rpf-netflow

Syntax Description

This command has no arguments or keywords.

Defaults

Multicast is disabled.

Command Modes

Interface configuration mode

Command History

Release	Modification
12.1(5c)EX	Support for this command was introduced on the Supervisor Engine 2.
12.1(8a)E	Support for this command on the Supervisor Engine 2 was extended to the 12.1 E release.

Usage Guidelines

An RPF interface is used if a unicast packet is sent back to the source.

If a multicast packet encounters an RPF MFD shortcut, it is not sent to the route processor on the MSFC. The router processor never sees a copy of the packet forwarded by the hardware. The RPF MFDs are installed to switch packets arriving on the RPF interface.

A non-RPF MFD is an MFD that is installed to switch packets on the non-RPF VLAN. With RPF MFDs, the packets arriving on the RPF VLAN are forwarded to the outgoing VLANs. With non-RPF MFDs, the packets are bridged only on the VLAN on which it was received. The packet is not sent to the MSFC.

Examples

This example shows how to enable the NetFlow-based non-RPF feature:

Router(config-if)# mls ip multicast non-rpf-netflow

Router(config-if)# 

Related Commands

mls ip multicast non-rpf-netflow (global configuration mode)
show mls ip multicast

mls ip multicast stub

To enable support for non-RPF traffic drops for PIM sparse-mode stub networks, use the mls ip multicast stub command. Use the no form of this command to disable this feature.

mls ip multicast stub

no mls ip stub

Syntax Description

This command has no arguments or keywords.

Defaults

Multicast is disabled.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(5c)EX	Support for this command was introduced on the Supervisor Engine 2.
12.1(8a)E	Support for this command on the Supervisor Engine 2 was extended to the 12.1 E release.

Usage Guidelines

When you enable the ACL-based method of filtering RPF failures by entering the mls ip multicast stub command on the redundant router, the following ACLs automatically download to the PFC and are applied to the interface you specify:

•access-list 100 permit ip A.B.C.0 0.0.0.255 any

•access-list 100 permit ip A.B.D.0 0.0.0.255 any

•access-list 100 permit ip any 224.0.0.0 0.0.0.255

•access-list 100 permit ip any 224.0.1.0 0.0.0.255

•access-list 100 deny ip any 224.0.0.0 15.255.255.255

The ACLs filter RPF failures and drop them in hardware so that they are not forwarded to the router.

Use the ACL-based method of filtering RPF failures only in sparse-mode stub networks where there are no downstream routers. For dense-mode groups, RPF failure packets have to be seen on the router for the PIM assert mechanism to function properly. Use CEF-or NetFlow-based rate limiting to rate limit RPF failures in dense-mode networks and sparse-mode transit networks.

Examples

This example shows how to enable support for non-RPF traffic drops for PIM sparse-mode stub networks:

Router(config-if)# mls ip multicast stub

Router(config-if)# 

Related Commands

show mls ip multicast

mls ip multicast threshold

To configure a threshold rate for installing hardware shortcuts, use the mls ip multicast threshold command. Use the no form of this command to deconfigure the threshold.

mls ip multicast threshold ppsec

no mls ip multicast threshold

Syntax Description

ppsec

Threshold in packets per seconds; valid values are from 10 to 10000 packets per second.

Defaults

This command has no default settings.

Command Modes

Global configuration

Command History

Release	Modification
12.1(3a)E3	Support for this command was introduced on the Catalyst 6500 series switches.
12.1(8a)E	Support for this command on the Catalyst 6500 series switches was extended to the 12.1 E release.

Usage Guidelines

Use this command to prevent creation of MLS entries for short-lived multicast flows such as join requests.

This command does not affect already installed routes. For example, if you enter this command and shortcuts are already installed, the shortcuts will not be removed if they are disqualified. To apply the threshold to existing routes, clear the route and let it reestablish.

Examples

This example shows how to configure the IP MLS threshold to 10 packets per second:

Router (config)# mls ip multicast threshold 10 

Router (config)# 

Related Commands

mls rp ip (global configuration mode)
show mls ip multicast

mls ip pbr

To enable MLS support for policy-routed packets, use the mls ip pbr command. Use the no form of this command to disable MLS support for policy-routed packets.

mls ip pbr [null0]

no mls ip pbr

Syntax Description

null0

(Optional) Enables the hardware support for the interface null0 in the route-maps.

Defaults

MLS support for policy-routed packets is disabled.

Command Modes

Global configuration

Command History

Release	Modification
12.1(12c)E1	This command was introduced on the Catalyst 6500 series switches.
12.1(22)E3	This command was changed to support the null0 keyword.

Usage Guidelines

The mls ip pbr command is supported on switches configured with a Supervisor Engine 1 only. On switches configured with a Supervisor Engine 2, PBR is performed in hardware by default.

When you enable hardware policy routing by entering the mls ip pbr command, all policy routing occurs in hardware and is applied to all interfaces, regardless of which interface was configured for policy routing.

Use the null0 keyword when you have routed traffic only to enable the hardware support for the set interface null0 in the route-maps.

Examples

This example shows how to enable MLS support for policy-routed packets:

Router(config)# mls ip pbr

Router(config)#

mls ipx (interface configuration mode)

To enable MLS IPX on the interface, use the mls ipx command. Use the no form of this command to disable IPX on the interface.

mls ipx

no mls ipx

Syntax Description

This command has no arguments or keywords.

Defaults

Multicast is disabled.

Command Modes

Interface configuration

Command History

Release	Modification
12.0(7)XE	Support for this command was introduced on the Catalyst 6500 series switches.
12.1(1)E	Support for this command on the Catalyst 6500 series switches was extended to the 12.1 E release.

Examples

This example shows how to enable MLS IPX on an interface:

Router(config-if)# mls ipx

Router(config-if)#

Related Commands

mls rp ipx (interface configuration mode)
show mls ipx

mls nde flow

To specify filter options for NDE, use the mls nde flow command. Use the no form of this command to clear the NDE flow filter and reset the filter to the default settings.

mls nde flow {include | exclude} {{dest-port port-num} | {destination ip-addr ip-mask} | {protocol {tcp | udp}} | {source ip-addr ip-mask} | {src-port port-num}}

no mls nde flow {include | exclude}

Syntax Description

include	Allows exporting of all flows except the flows matching the given filter.
exclude	Allows exporting of all flows matching the given filter.
dest-port port-num	Specifies the destination port to filter; valid values are from 1 to 100.
destination ip-addr maskbit	Specifies a destination IP address and mask bits to filter.
protocol	Specifies the protocol to include or exclude.
tcp	Includes or excludes TCP.
udp	Includes or excludes UDP.
source ip-addr ip-mask	Specifies a source IP address and mask bits to filter.
src-port port-num	Specifies the source port to filter.

Defaults

The defaults are as follows:

•All expired flows are exported until the filter is specified explicitly.

•Interface export is disabled (no mls nde interface).

Command Modes

Global configuration

Command History

Release	Modification
12.0(7)XE	Support for this command was introduced on the Catalyst 6500 series switches.
12.1(1)E	Support for this command on the Catalyst 6500 series switches was extended to the 12.1 E release.

Usage Guidelines

The mls nde flow command adds filtering to the NDE. Expired flows matching the specified criteria are exported. These values are stored in NVRAM and do not clear when NDE is disabled. If any option is not specified in this command, it is treated as a wildcard. The NDE filter in NVRAM does not clear when NDE is disabled.

Only one filter can be active at a time. If you do not enter the exclude or include keyword, the filter is assumed to be an inclusion filter.

The include and exclude filters are stored in NVRAM and are not removed if NDE is disabled.

Use the long subnet address format when specifying the source ip-addr ip-mask; for example, source 172.22.252.00 255.255.252.00 indicates a 22-bit subnet address. This format can specify a subnet address of any bit number. To provide more flexibility, the ip-addr is a full host address, such as 172.22.253.1 255.255.252.00.

Examples

This example shows how to specify an interface flow filter so that only expired flows to destination port 23 are exported (assuming the flow mask is set to ip-flow):

Router(config)# mls nde flow include dest-port 35

Router(config)#

Related Commands

show mls netflow

mls nde interface

To populate additional fields in the NDE packets, use the mls nde interface command. Use the no form of this command to disable the population of the additional fields.

mls nde interface

no mls nde interface

Syntax Description

This command has no arguments or keywords.

Defaults

Disabled

Command Modes

Interface configuration

Command History

Release	Modification
12.1(13)E	Support for this command was introduced on the Catalyst 6500 series switches.

Usage Guidelines

With Release 12.1(13)E and later releases, you can configure NDE to populate the following additional fields in the NDE packets:

•Egress interface SNMP index

•Source autonomous system number

•Destination autonomous system number

•IP address of the next hop router

The Ingress interface SNMP index is always populated if the flow mask is interface-full or interface-src-dst.

For detailed information, refer to the "Configuring NDE" chapter of the Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide.

Examples

This example shows how to populate additional fields in the NDE packets:

Router(config)# mls nde interface

Router(config)#

This example shows how to disable the population of the additional fields:

Router(config)# no mls nde interface

Router(config)#

Related Commands

mls netflow
mls netflow sampling

mls nde sender

To enable the MLS NDE export feature, use the mls nde sender command. Use the no form of this command to disable the feature.

mls nde sender [version version]

no mls nde sender

Syntax Description

version version

(Optional) Specifies the NDE version; valid values are 5 and 7.

Defaults

The defaults are as follows:

•MLS NDE export feature is disabled.

•version is 7.

Command Modes

Global configuration

Command History

Release	Modification
12.1(8a)E2	Support for this command was introduced on the Catalyst 6500 series switches.
12.1(13)E	This command was changed to support NDE version 5.

Usage Guidelines

If you do not enter a version, the default version is 7.

NDE on the PFC supports the following NDE versions to export the statistics captured on the PFC for Layer 3-switched traffic:

•Supervisor Engine 1 and PFC support NDE version 7

•Supervisor Engine 2 and PFC2 support these versions:

–NDE versions 5 and 7 with Release 12.1(13)E and later releases

–NDE version 7 only for releases prior to Release 12.1(13)E

NDE version 7 is supported on Catalyst 6500 series switches configured with a Supervisor Engine 2 only.

Examples

This example shows how to enable the MLS NDE export feature:

Router(config)# mls nde sender

Router(config)#

This example shows how to disable the MLS NDE export feature:

Router(config)# no mls nde sender

Router(config)#

Related Commands

show mls nde

mls nde src_address

To specify the source IP address used by the switch processor to send NDE packets to the Netflow Collector, use the mls nde src_address command. Use the no form of this command to remove a prior entry.

mls nde src_address ip-addr [version version]

no mls nde src_address ip-addr

Syntax Description

ip-addr	Source IP address of the NDE collector.
version version	(Optional) Keyword and variable to specify the NDE version; valid value is 7.

Defaults

Disabled

Command Modes

Global configuration

Command History

Release	Modification
12.0(7)XE	Support for this command was introduced on the Catalyst 6500 series switches.
12.1(1)E	Support for this command on the Catalyst 6500 series switches was extended to the 12.1 E release.
12.1(11b)E	This command was deprecated.

Usage Guidelines

When entering the ip-addr, the following guidelines must be used:

•The NDE source IP address you configure must be an unused address from the subnet of a router interface, and cannot be an address currently used by the interface.

•You cannot use an address from a subnet on a loopback interface.

When entering the version, the valid values are 7 and 8, but only version 7 is supported.

Examples

This example shows how to designate the source IP address of an NDE collector:

Router(config)# mls nde src_address 172.20.52.29

Router(config)#

Related Commands

show mls netflow

mls netflow

To enable the ability to create MLS NetFlow entries, use the mls netflow command. Use the no form of this command to disable the feature.

mls netflow

no mls netflow

Syntax Description

This command has no arguments or keywords.

Defaults

Enabled

Command Modes

Global configuration

Command History

Release	Modification
12.0(7)XE	Support for this command was introduced on the Catalyst 6500 series switches.
12.1(1)E	Support for this command on the Catalyst 6500 series switches was extended to the 12.1 E release.

Usage Guidelines

If you are not using NDE or the Cisco IOS features that use the hardware NetFlow table (micro-flow QoS, WCCP, TCP Intercept, or Reflexive ACLs), you may safely disable the use and maintenance of the hardware NetFlow table using the no mls netflow global configuration command.

Examples

This example shows how to enable the ability to create MLS NetFlow entries:

Router(config)# mls netflow

Router(config)#

This example shows how to disable the ability to create MLS NetFlow entries:

Router(config)# no mls netflow

Disabling MLS netflow entry creation.

Router(config)#

Related Commands

show mls netflow

mls netflow maximum-flows

To configure the maximum flow allocation in the NetFlow table, use the mls netflow maximum-flows command. Use the no form of this command to return to the default settings.

mls netflow maximum-flows [maximum-flows]

no mls netflow maximum-flows

Syntax Description

maximum-flows

(Optional) Specifies the maximum number of flows; valid values are 16, 32, 64, 80, 96, and 128. See the "Usage Guidelines" section for additional information.

Defaults

128

Command Modes

Global configuration

Command History

Release	Modification
12.1(23)E	Support for this command was introduced on the the Supervisor Engine 2.

Usage Guidelines

The value that you specify for the maximum number of flows is that value times 1000. For example, if you enter 32, you specify that 32,000 is the maximum number of permitted flows.

Examples

This example shows how to configure the maximum flow allocation in the NetFlow table:

Router(config)# mls netflow maximum-flows 96

Router(config)#

This example shows how to return to the default settings:

Router(config)# no mls netflow maximum-flows

Router(config)# 

Related Commands

show mls netflow table-contention