This document gives examples on how to obtain MAC and IP address accounting information from Cisco routers using Simple Network Management Protocol (SNMP).
There are no specific requirements for this document.
This document is not restricted to specific software and hardware versions.
For more information on document conventions, refer to the Cisco Technical Tips Conventions.
The MAC address accounting feature provides accounting information for IP traffic based on the source and destination MAC addresses on LAN interfaces. This feature calculates the total packet and byte counts for a LAN interface that receives or sends IP packets to or from a unique MAC address. It also records a timestamp for the last packet received or sent.
From a command line, you get this result:
router_10.64.7.2#show running <snip> ... interface FastEthernet2/0 ip address 10.64.7.2 255.255.255.248 ip accounting mac-address input ip accounting Mac-address output ... <snip> ... snmp-server community public RO SNMP-server community private RW ... <snip> router_10.64.7.2#show interfaces mac FastEthernet2/0 Input (486 free) 0000.0c75.4120(24 ): 19349 packets, 1608842 bytes, last: 5360ms ago 00e0.1e3f.6989(33 ): 19272 packets, 1597208 bytes, last: 1276ms ago ... 0040.0550.bc5c(245): 207 packets, 44890 bytes, last: 174440ms ago Total: 1091720 packets, 178475402 bytes Output (506 free) 0040.ca19.c776(34 ): 3744 packets, 400075 bytes, last: 81804ms ago ... 0090.bf1f.e000(208): 229537 packets, 64266576 bytes, last: 0ms ago Total: 266111 packets, 70376527 bytes router_10.64.7.2#
Alternatively, it is possible to obtain the above information using SNMP from CISCO-IP-STAT-MIB as shown:
% snmpwalk 10.64.7.2 public .188.8.131.52.184.108.40.206.220.127.116.11 enterprises.18.104.22.168.22.214.171.124.126.96.36.199.188.8.131.52 = Counter32: 19349 ... enterprises.184.108.40.206.220.127.116.11.18.104.22.168.22.214.171.124 = Counter32: 19040 enterprises.126.96.36.199.188.8.131.52.184.108.40.206.220.127.116.11 = Counter32: 1608842 ... enterprises.18.104.22.168.22.214.171.124.126.96.36.199.188.8.131.52 = Counter32: 1485120
public = RO community string 184.108.40.206.220.127.116.11.18.104.22.168 = cipMacTable 22.214.171.124.126.96.36.199.188.8.131.52.1.3 = cipMacSwitchedPkts 184.108.40.206.220.127.116.11.18.104.22.168.1.4 = cipMacSwitchedBytes
Take one of the examples from the snmpwalk command output.
For the first half of the output, that is, cipMacSwitchedPkts:
enterprises.22.214.171.124.126.96.36.199.188.8.131.52.184.108.40.206 = Counter32: 19349
Here, the 9 is the ifIndex, and the 1 is cipMacDirection.
So, 0.0.12.117.65.32 is the MAC address, that is, 0000.0c75.4120. The MAC address is in decimal: 0.0.12.117.65.32 (which translates to 0000.0c75.4120 in hexadecimal).
The number of packets = 19349.
For the second half of the SNMP output, that is, cipMacSwitchedBytes:
enterprises.220.127.116.11.18.104.22.168.22.214.171.124.126.96.36.199 = Counter32: 1608842
Here, the 9 is the ifIndex and the 1 is cipMacDirection.
So, 0.0.12.117.65.32 is the MAC address, that is, 0000.0c75.4120.
The number of bytes = 1608842. This corresponds to the following entry in the show interfaces mac command output:
router_10.64.7.2#show interfaces mac FastEthernet2/0 Input (486 free) 0000.0c75.4120(24 ): 19349 packets, 1608842 bytes, last: 5360ms ago ...
Further information is available at:
By enabling IP accounting, users can see the number of bytes and packets switched through the Cisco IOS Software on a source and destination IP address basis. Only transit IP traffic is measured and only on an outbound basis; traffic generated by the software or terminating in the software is not included in the accounting statistics.
To maintain accurate accounting totals, the software maintains two accounting databases: an active and a checkpointed database. There are two tables in OLD-CISCO-IP-MIB.my, which are lipCkAccountingTable (the checkpoint database) and lipAccountingTable (the active database). The actCheckPoint copies the active database into the checkpoint database. Consequently, the show ip accounting command is cleared.
A network management system (NMS) can use lipCkAccountingTable from the MIB to analyze stable data in the checkpoint database. The running, or active, database is copied into the checkpoint database. If the checkpoint database already has data obtained previously from the active database, the router appends the latest copy of the active database to the existing data in the checkpoint database. The checkpoint database stores data retrieved from the active database until actCheckPoint is set, or until you delete the contents of this database by issuing the clear ip accounting [checkpoint] command.
The MIB actCheckPoint activates a checkpoint database. This variable must be read and then set to the same value that was read. The value that is read and then set is incremented after a successful set request. The configuration on the router is as follows:
<snip> ... interface FastEthernet2/0 ip address 10.64.7.2 255.255.255.248 ip accounting output-packets ... <snip>
Use checkpointing and retrieve the data from the checkpoint database using SNMP to get accurate accounting data.
A two-step process is needed to set up the checkpoint and to copy the data from the active database to the checkpoint database:
Read the value of actCheckPoint (188.8.131.52.184.108.40.206.4.11).
% snmpget -v 1 10.64.7.2 public .220.127.116.11.18.104.22.168.4.11.0 enterprises.22.214.171.124.0 = 0
Set the actCheckPoint to the value that was just read.
% snmpset 10.64.7.2 private .126.96.36.199.188.8.131.52.4.11.0 i 0 enterprises.184.108.40.206.0 = 0
Note: If the set is successful the value of actCheckPoint increments by one.
% snmpget -v 1 10.64.7.2 public .220.127.116.11.18.104.22.168.4.11.0 enterprises.22.214.171.124.0 = 1
Here, you do not really delete the IP checkpoint accounting table. When you checkpoint the table, you copy the live table to the checkpoint table, and reinitialize the live table. Checkpointing as above deletes or reinitializes the IP accounting table. To retrieve the IP checkpoint accounting table, snmpwalk the lipCkAccountingTable.
Note: 126.96.36.199.188.8.131.52.4.9 = lipCkAccountingTable:
% snmpwalk 10.64.7.2 public .184.108.40.206.220.127.116.11.4.9 enterprises.18.104.22.168.22.214.171.124.126.96.36.199.111.59 = IpAddress: 10.64.7.26 enterprises.188.8.131.52.184.108.40.206.220.127.116.11.110.223 = IpAddress: 172.17.110.208 enterprises.18.104.22.168.22.214.171.124.126.96.36.199.111.59 = IpAddress: 172.17.111.59 enterprises.188.8.131.52.184.108.40.206.220.127.116.11.110.223 = IpAddress: 172.17.110.223 enterprises.18.104.22.168.22.214.171.124.126.96.36.199.111.59 = 29 enterprises.188.8.131.52.184.108.40.206.220.127.116.11.110.223 = 57 enterprises.18.104.22.168.22.214.171.124.126.96.36.199.111.59 = 2436 enterprises.188.8.131.52.184.108.40.206.220.127.116.11.110.223 = 5700 enterprises.18.104.22.168.22.214.171.124.126.96.36.199.111.59 = 0 enterprises.188.8.131.52.184.108.40.206.220.127.116.11.110.223 = 0
From the router_10.64.7.2:
router_10.64.7.2#show ip account Source Destination Packets Bytes 172.17.110.208 172.17.110.223 25 2500 10.64.7.26 172.17.111.59 13 1092
The accounting data age is 0.
In summary, setting the actCheckPoint erases data in the lipCkAccountingTable. In other words, this starts with a brand new database.
Further information is available at:
The Cisco Support Community is a forum for you to ask and answer questions, share suggestions, and collaborate with your peers.
Refer to Cisco Technical Tips Conventions for information on conventions used in this document.