To configure which applications which will receive an alarm or notification, use the actioncommand in policy react configuration mode and policy inline react configuration mode. To disable the sending alarms or notifications, use the no form of this command.
syslog |
Sends an alarm or notification to the syslog. |
snmp |
Sends an alarm or notification to the SNMP MIB variables. |
eem |
Sends an alarm or notification to Cisco Embedded Event Manager. |
Information is saved to syslog.
Policy react configuration (config-pmap-c-react)
Policy inline react configuration (config-spolicy-inline-react)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
You can configure multiple action commands to allow more than one recipients to receive an alarm or notification.
The following example shows how to specify that SNMP MIB variables will receive an alarm or notification, while configuring a policy-map:
Router(config)# policy-map type performance-monitor policy-4 Router(config-pmap)# class PM-CLASS-4 Router(config-pmap-c)# react 2000 rtp-jitter-average Router(config-pmap-c-react)# action snmp
The following example shows how to specify that SNMP MIB variables will receive an alarm or notification, while associating a service-policy with an interface:
Router(config)# interface ethernet 0/0 Router(config-if)# service-policy type performance-monitor inline input Router(config-if-spolicy-inline)# react 2000 rtp-jitter-average Router(config-spolicy-inline-react)# action snmp
Command |
Description |
---|---|
policy-map type performance-monitor |
Creates a policy for Performance Monitor. |
service-policy type performance-monitor |
Associates a policy with an interface. |
To configure the severity of alarms sent for a Performance Monitor policy, use the alarm severitycommand in policy react configuration mode and policy inline react configuration mode. To return to the default and send all alarms, use the no form of this command.
alert |
Sends only alerts. |
critical |
Sends only critical alarms. |
emergency |
Sends only emergency alarms. |
error |
Sends only errors. |
info |
Sends only informational messages. |
All alarm severities are sent.
Policy react configuration (config-pmap-c-react)
Policy inline react configuration (config-spolicy-inline-react)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
The definition of the alarms types are listed below in order of severity:
The following example shows how to specify that only emergency alarms will be sent, while configuring a policy-map:
Router(config)# policy-map type performance-monitor policy-4 Router(config-pmap)# class PM-CLASS-4 Router(config-pmap-c)# react 2000 rtp-jitter-average Router(config-pmap-c-react)# alarm severity emergency
The following example shows how to specify that only emergency alarms will be sent, while associating a service-policy with an interface:
Router(config)# interface ethernet 0/0 Router(config-if)# service-policy type performance-monitor inline input Router(config-if-spolicy-inline)# react 2000 rtp-jitter-average Router(config-spolicy-inline-react)# alarm severity emergency
Command |
Description |
---|---|
policy-map type performance-monitor |
Creates a policy for Performance Monitor. |
service-policy type performance-monitor |
Associates a policy with an interface. |
To configure the types of alarms sent for a Performance Monitor policy, use the alarm typecommand in policy react configuration mode and policy inline react configuration mode. To return to the default and send all alarms, use the no form of this command.
discrete |
Sends only individual alarms. |
grouped |
Sends only grouped alarms. |
count number |
Send alarms only when the count of the monitored event is above the specified number |
percent number |
Send alarms only when percentage of the monitored event is above the specified number. |
Alarm type is set to discrete.
Policy react configuration (config-pmap-c-react)
Policy inline react configuration (config-spolicy-inline-react)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
The monitored event is specified by the react command. You can group alarms by whether they exceed a specified percentage or count.
The following example shows how to specify that only percentage type alarms will be sent, while configuring a policy-map:
Router(config)# policy-map type performance-monitor policy-4 Router(config-pmap)# class PM-CLASS-4 Router(config-pmap-c)# react 2000 rtp-jitter-average Router(config-pmap-c-react)# alarm type percent 80
The following example shows how to specify that only percentage type alarms will be sent, while associating a service-policy with an interface:
Router(config)# interface ethernet 0/0 Router(config-if)# service-policy type performance-monitor inline input Router(config-if-spolicy-inline)# react 2000 rtp-jitter-average Router(config-spolicy-inline-react)# alarm type percent 80
Command |
Description |
---|---|
policy-map type performance-monitor |
Creates a policy for Performance Monitor. |
service-policy type performance-monitor |
Associates a policy with an interface. |
To configure the number cache entries for a Performance Monitor flow monitor, use the cache entriescommand in flow monitor configuration mode. To remove the configuration, use the no form of this command.
number |
Specifies the number of entries. |
No cache entries are configured.
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The following example shows how to set the number cache entries to 200, while configuring a flow monitor for Performance Monitor:
Router(config)# flow monitor type performance-monitor monitor-4 Router(config-flow-monitor)# cache entries 200 Router(config-flow-monitor)# record r2 Router(config-flow-monitor)# exporter e2
Command |
Description |
---|---|
flow monitor type performance-monitor |
Creates a flow monitor for Performance Monitor. |
To configure the cache timeout for a Performance Monitor flow monitor, use the cache timeoutcommand in flow monitor configuration mode. To remove the configuration, use the no form of this command.
active |
Specifies an active timeout. |
inactive |
Specifies an inactive timeout. |
synchronized |
Specifies a synchronized timeout. |
timeout |
Specifies that the duration of the second. |
event transaction end |
Specifies that the timeout occurs when the transaction ends. |
No timeout is configured.
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The following example shows how to set an active cache timeout of 20 seconds, while configuring a flow monitor for Performance Monitor:
Router(config)# flow monitor type performance-monitor monitor-4 Router(config-flow-monitor)# cache timeout active 20 Router(config-flow-monitor)# record r2 Router(config-flow-monitor)# exporter e2
Command |
Description |
---|---|
flow monitor type performance-monitor |
Creates a flow monitor for Performance Monitor. |
To configure the cache type for a Performance Monitor flow monitor, use the cache typecommand in flow monitor configuration mode. To remove the configuration, use the no form of this command.
permanent |
Specifies a permanent cache. |
normal |
Specifies a normal cache. |
synchronized |
Specifies a synchronized cache. |
No cache type is configured.
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The following example shows how to configure a normal cache, while configuring a flow monitor for Performance Monitor:
Router(config)# flow monitor type performance-monitor monitor-4 Router(config-flow-monitor)# cache type normal Router(config-flow-monitor)# record r2 Router(config-flow-monitor)# exporter e2
Command |
Description |
---|---|
flow monitor type performance-monitor |
Creates a flow monitor for Performance Monitor. |
To create a class map to be used for matching packets to a specified class and to enter QoS class-map configuration mode, use the class-map command in global configuration mode. To remove an existing class map from a device, use the no form of this command.
A class map is not configured.
Global configuration (config)
Release |
Modification |
---|---|
12.0(5)T |
This command was introduced. |
12.0(5)XE |
This command was integrated into Cisco IOS Release 12.0(5)XE. |
12.0(7)S |
This command was integrated into Cisco IOS Release 12.0(7)S. |
12.1(1)E |
This command was integrated into Cisco IOS Release 12.1(1)E. |
12.2(14)SX |
This command was integrated into Cisco IOS Release 12.2(14)SX and implemented on Cisco 7600 series routers. |
12.2(17d)SXB |
This command was integrated into Cisco IOS Release 12.2(17d)SXB and implemented on Cisco 7600 series routers. |
12.2(33)SRA |
This command was integrated into Cisco IOS Release 12.2(33)SRA. |
12.4(4)T |
This command was modified. The stack and access-control keywords were added to support FPM. The port-filter and queue-threshold keywords were added to support control-plane protection. |
12.4(6)T |
This command was modified. The logging log-class keyword and argument pair was added to support control-plane packet logging. |
12.2(18)ZY |
This command was modified. The stack and access-control keywords were integrated into Cisco IOS Release 12.2(18)ZY on Catalyst 6500 series switches equipped with the programmable intelligent services accelerator (PISA). |
Cisco IOS XE Release 2.1 |
This command was integrated into Cisco IOS XE Release 2.1 and implemented on Cisco ASR 1000 Series Aggregation Services Routers. |
15.1(3)T |
This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor with the class-map-name argument as the only syntax element available. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor with the class-map-name argument. |
12.2(33)SCF |
This command was integrated into Cisco IOS Release 12.2(33)SCF. |
15.2(3)T |
This command was modified. The software does not accept spaces in a class map name entered without quotation marks. |
15.1(2)SNG |
This command was integrated into Cisco ASR 901 Series Aggregation Services Routers. |
Only the class-map-name argument is available.
Use the class-map command to specify the class that you will create or modify to meet the class-map match criteria. This command enters QoS class-map configuration mode in which you can enter one or more match commands to configure the match criteria for this class. Packets that arrive at either the input interface or the output interface (determined by how the service-policy command is configured) are checked against the match criteria that are configured for a class map to determine if packets belong to that class.
When configuring a class map, you can use one or more match commands to specify the match criteria. For example, you can use the match access-group command, the match protocol command, or the match input-interface command. The match commands vary according to the Cisco software release. For more information about match criteria and match commands, see the "Modular Quality of Service Command-Line Interface (CLI) (MQC)" chapter of the Cisco IOS Quality of Service Solutions Configuration Guide.
Apply the class-map command and commands available in QoS class-map configuration mode on a per-interface basis to define packet classification, marking, aggregating, and flow policing as part of a globally named service policy.
You can attach a service policy to an EtherChannel. Do not attach a service policy to a port that is a member of an EtherChannel.
When a device is in QoS class-map configuration mode, the following configuration commands are available:
The following commands appear in the CLI help but are not supported on LAN interfaces or WAN interfaces on Optical Service Modules (OSMs):
OSMs are not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 32.
Policy Feature Card (PFC) QoS does not support the following commands:
If you enter these commands, PFC QoS does not detect unsupported keywords until you attach a policy map to an interface. When you try to attach the policy map to an interface, an error message is generated. For additional information, see the Cisco 7600 Series Router Cisco IOS Software Configuration Guide and Cisco IOS command references.
After configuring the class-map name and the device you can enter the match access-group and match ip dscp commands in QoS class-map configuration mode. The syntax for these commands is as follows:
match [access-group {acl-index | acl-name} | ip dscp | precedence} value]
See the table below for a description of match command keywords.
Table 1 | match command Syntax Description |
Optional command |
Description |
---|---|
access-group acl-index | acl-name |
(Optional) Specifies the access list index or access list names. Valid access list index values are from 1 to 2699. |
access-group acl-name |
(Optional) Specifies the named access list. |
ip dscp value1 value2 ... value8 |
(Optional) Specifies IP differentiated services code point (DSCP) values to match. Valid values are from 0 to 63. You can enter up to eight DSCP values separated by spaces. |
ip precedence value1 value2 ... value8 |
(Optional) Specifies the IP precedence values to match. Valid values are from 0 to 7. You can enter up to eight precedence values separated by spaces. |
The following example shows how to specify class101 as the name of a class and define a class map for this class. The class named class101 specifies policy for the traffic that matches ACL 101.
Device(config)# class-map class101 Device(config-cmap)# match access-group 101 Device(config-cmap)# end
The following example shows how to define FPM traffic classes for slammer and UDP packets. The match criteria defined within class maps are for slammer and UDP packets with an IP length that does not exceed 404 (0x194) bytes, UDP port 1434 (0x59A), and pattern 0x4011010 at 224 bytes from the start of the IP header.
Device(config)# load protocol disk2:ip.phdf Device(config)# load protocol disk2:udp.phdf Device(config)# class-map type stack match-all ip-udp Device(config-cmap)# description "match UDP over IP packets" Device(config-cmap)# match field ip protocol eq 0x11 next udp Device(config-cmap)#exit Device(config)# class-map type access-control match-all slammer Device(config-cmap)# description "match on slammer packets" Device(config-cmap)# match field udp dest-port eq 0x59A Device(config-cmap)# match field ip length eq 0x194 Device(config-cmap)# match start 13-start offset 224 size 4 eq 0x 4011010 Device(config-cmap)# end
The following example shows how to configure a port-filter policy to drop all traffic that is destined to closed or "nonlistened" ports except Simple Network Management Protocol (SNMP):
Device(config)# class-map type port-filter pf-class Device(config-cmap)# match not port udp 123 Device(config-cmap)# match closed-ports Device(config-cmap)# exit Device(config)# policy-map type port-filter pf-policy Device(config-pmap)# class pf-class Device(config-pmap-c)# drop Device(config-pmap-c)# end
The following example shows how to configure a class map named ipp5 and enter a match statement for IP precedence 5:
Device(config)# class-map ipp5 Device(config-cmap)# match ip precedence 5
The following example shows how to set up a class map and match traffic classes for the 802.1p domain with packet class of service (CoS) values:
Device> enable Device# configure terminal Device(config)# class-map cos1 Device(config-cmap)# match cos 0 Device(config-pmap-c)# end
The following example shows how to set up a class map and match traffic classes for the Multiprotocol Label Switching (MPLS) domain with packet experimental (EXP) values:
Device> enable Device# configure terminal Device(config)# class-map exp7 Device(config-cmap)# match mpls experimental topmost 2 Device(config-pmap-c)# end
Command |
Description |
---|---|
description | Specifies the description for a class map or policy map configuration. |
drop | Configures the traffic class to discard packets belonging to a specific class map. |
class (policy-map) |
Specifies the name of the class whose policy you want to create or change, and the default class before you configure its policy. |
load protocol |
Loads a PHDF onto a router. |
match (class-map) |
Configures the match criteria for a class map on the basis of port filter or protocol queue policies. |
match access-group |
Configures the match criteria for a class map on the basis of the specified ACL. |
match input-interface |
Configures a class map to use the specified input interface as a match criterion. |
match ip dscp |
Identifies one or more DSCP, AF, and CS value as a match criterion. |
match mpls experimental |
Configures a class map to use the specified EXP field value as a match criterion. |
match protocol |
Configures the match criteria for a class map on the basis of the specified protocol. |
policy-map |
Creates or modifies a policy map that can be attached to one or more interfaces to specify a service policy. |
protocol | Configures a timer and authentication method for a control interface. |
qos-group | Associates a QoS group value for a class map. |
service-policy |
Attaches a policy map to an input interface or VC or to an output interface or VC to be used as the service policy for that interface or VC. |
show class-map |
Displays class map information. |
show policy-map interface |
Displays statistics and configurations of input and output policies that are attached to an interface. |
source-address |
Configures the source-address control on a port. |
To clear counters for the Performance Monitor component of Feature Monitor, use the clear fm performance-monitor counterscommand in privileged EXEC mode.
This command has no arguments or keywords.
Counters for the Performance Monitor are not cleared.
Privileged EXEC (#)
Release |
Modification |
---|---|
15.0(1)SY |
This command was introduced on the Catalyst 6500 platform. |
This command is available only on the Catalyst 6500 platform.
The following example shows the how to clear counters for the Performance Monitor component of Feature Monitor:
Router# clear fm performance-monitor counters
Command |
Description |
---|---|
show platform hardware acl entry interface |
Displays information about inbound and outbound access control list (ACL) ternary content addressable memory (TCAM) interface entries. |
show platform software ccm |
Displays information about ternary content addressable memory (TCAM) Cisco CallManager (CCM) entries. |
show platform software feature-manager performance-monitor |
Displays information about the Performance Monitor component of Feature Manager. |
show platform software feature-manager tcam |
Displays information about dynamic ternary content addressable memory (TCAM) entries for the Performance Monitor component of Feature Manager. |
To configure the rate for the RTP packet time-stamp clock, use the clock-ratecommand in policy RTP configuration mode. To remove the configuration, use the no form of this command.
type-number |
An integer between 0 and 34. This value is compared with the payload type field in the RTP header. Values between 0 and 23 are reserved for audio streams, and values between 24 and 34 are reserved for video streams. |
type-name |
The name of the payload type field in the RTP header. |
rate |
Clock rate in Hz. The range is from 9600 to 124000. |
Clock rate is 90000.
policy RTP configuration (config-pmap-c-mrtp)
policy inline RTP configuration (config-spolicy-inline-mrtp)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
For more information about how the clock rate for RTP packet time-stamp clock is used to calculate the packet arrival latency, see RFC 3550, RTP, A Transport Protocol for Real-Time Applications . The clock rate has to be synchronized with the routers along the path of the flow. Because the clock rate can vary depending on the payload codec type, a keyword is provided to set the expected clock rate.
The available values for type-name and type-numberare celb (25), cn (13), dvi4 (5) (8000 Hz as described in RFC 3551, RTP Profile for Audio and Video Conferences with Minimal Control ), dvi4-2 (6) (8000 Hz as described in RFC 3551), dvi4-3 (16) (DVI4 Dipol 11025 Hz), dvi4-4 (17) DVI4 Dipol 22050 Hz), g722 (9), g723 (4), g728 (15), g729 (18), gsm (3), h261 (31), h263 (34), jpeg (26), l16 (11) (L16 channel 1), l16-2 (10) (L16 channel 2), lpc (7), mp2t (33), mpa (14), mpv (32), nv (28), pcma (8), pcmu (0), qcelp (12).
The following example shows how to set the rate for the RTP packet time-stamp clock,while configuring a policy-map:
Router(config)# policy-map type performance-monitor policy-4 Router(config-pmap)# class PM-CLASS-4 Router(config-pmap-c)# monitor metric rtp Router(config-pmap-c-mrtp)# clock-rate 8 9600
The following example shows how to set the rate for the RTP packet time-stamp clock, while associating a service-policy with an interface:
Router(config)# interface ethernet 0/0 Router(config-if)# service-policy type performance-monitor inline input Router(config-if-spolicy-inline)# monitor metric rtp Router(config-spolicy-inline-mrtp)# clock-rate 8 9600
Command |
Description |
---|---|
policy-map type performance-monitor |
Creates a policy for Performance Monitor. |
service-policy type performance-monitor |
Associates a policy with an interface. |
To configure one or more of the application description field as a nonkey field for a flow record, use the collect application description command in flow record configuration mode. To disable the use the application fields as a key field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The application description field is not configured as a nonkey field.
Release |
Modification |
---|---|
15.2(3)T |
This command was introduced. |
Cisco IOS XE Release 3.6S. |
This command was integrated into Cisco IOS XE Release 3.6S. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the application description as a nonkey field for Performance Monitor:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect application description
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one of the HTTP application fields as a nonkey field for a flow record, use the collect application http host command in flow record configuration mode. To disable the use the HTTP application fields as a key field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The HTTP application fields are not configured as a nonkey field.
Release |
Modification |
---|---|
15.2(4)S |
This command was introduced. |
Cisco IOS XE Release 3.7S |
This command was integrated into Cisco IOS XE Release 3.7S. |
15.2(4)M2 |
This command was integrated into Cisco IOS Release 15.2(4)M2 for MACE. |
15.3(1)T |
This command was integrated into Cisco IOS Release 15.3(1)T for MACE. |
This command can be used with Flexible NetFlow, MACE (Measurement, Aggregation, and Correlation Engine), and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for all three products, here we refer to the command mode for these products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the HTTP application host as a nonkey field for Flexible Netflow:
Router(config)# flow record RECORD-1 Router(config-flow-record)# collect application http host
The following example configures the HTTP application host as a nonkey field for Performance Monitor:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect application http host
The following example configures the HTTP application URI statistics as a nonkey field for Performance Monitor:
Router(config)# flow record type mace RECORD-1 Router(config-flow-record)# collect application http uri statistics
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
flow record type mace |
Creates a flow record, and enters MACE flow record configuration mode. |
To configure one of the application media fields as a nonkey field for a flow record, use the collect application media command in flow record configuration mode. To disable the use of one of the application media field as a nonkey field for a flow record, use the no form of this command.
bytes rate |
Configures the field that counts the rate of bytes collected, in Bps, for all flows, as a nonkey field. |
bytes counter |
Configures the field that counts the total number of bytes collected, as a nonkey field. |
long |
Configures the field for the long count (byte or packet) as a nonkey field. |
packets rate |
Configures the field that counts the total number of application media packets collected, per second, for all flows, as a nonkey field. |
variation |
Configures the field for the variation in the rate application media packets collected, for all flows, as a nonkey field. |
packets counter |
Configures the filed that counts the total number of application media packets collected, for all flows, as a nonkey field. |
events |
Configures the field that indicates whether one of the media application thresholds configured for the flow was crossed at least once in the monitoring interval, field as a nonkey field. |
The application media field is not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures application media packet field as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect application media packets
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the use of the application name as a nonkey field for a flow record, use the collect application name command in flow record configuration mode. To disable the use of the application name as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The application name is not configured as a non-key field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
15.0(1)M |
This command was introduced. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
15.2(3)T |
This command was integrated into Cisco IOS Release 15.2(3)T for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the match command.
The following example configures the application name as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect application name
The following example configures the application name as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect application name
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
match application name |
Configures the use of application name as a key field for a Flexible NetFlow flow record. |
To configure the NNTP application group name field as a nonkey field for a flow record, use the collect application nntp group-name command in flow record configuration mode. To disable the use the application fields as a key field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The application version field is not configured as a nonkey field.
Release |
Modification |
---|---|
15.2(4)S |
This command was introduced. |
Cisco IOS XE Release 3.7S |
This command was integrated into Cisco IOS XE Release 3.7S. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the NNTP application group name as a nonkey field for Flexible Netflow:
Router(config)# flow record RECORD-1 Router(config-flow-record)# collect application nntp group-name
The following example configures the NNTP application group name as a nonkey field for Performance Monitor:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect application nntp group-name
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the POP3 application server field as a nonkey field for a flow record, use the collect application pop3 server command in flow record configuration mode. To disable the use the application fields as a key field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The application version field is not configured as a nonkey field.
Release |
Modification |
---|---|
Cisco IOS XE Release 3.7S |
This command was introduced. |
The fields collected by this command can only extracted using the IPFIX export protocol.
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the POP3 application server as a nonkey field for Flexible Netflow:
Router(config)# flow record RECORD-1 Router(config-flow-record)# collect application pop3 server
The following example configures the POP3 application server as a nonkey field for Performance Monitor:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect application pop3 server
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the RTSP application hostname field as a nonkey field for a flow record, use the collect application rtsp host-name command in flow record configuration mode. To disable the use the application fields as a key field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The application version field is not configured as a nonkey field.
Release |
Modification |
---|---|
Cisco IOS XE Release 3.7S |
This command was introduced. |
The fields collected by this command can only extracted using the IPFIX export protocol.
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the RTSP application hostname as a nonkey field for Flexible Netflow:
Router(config)# flow record RECORD-1 Router(config-flow-record)# collect application rtsp host-name
The following example configures the RTSP application hostname as a nonkey field for Performance Monitor:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect application rtsp host-name
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the SIP application destination or source field as a nonkey field for a flow record, use the collect application sip command in flow record configuration mode. To disable the use the application fields as a key field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The application version field is not configured as a nonkey field.
Release |
Modification |
---|---|
Cisco IOS XE Release 3.7S |
This command was introduced. |
The fields collected by this command can only extracted using the IPFIX export protocol.
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the SIP application source as a nonkey field for Flexible Netflow:
Router(config)# flow record RECORD-1 Router(config-flow-record)# collect application sip source
The following example configures the application SMTP hostname as a nonkey field for Performance Monitor:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect application sip source
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the SMTP application server or sender field as a nonkey field for a flow record, use the collect application smtp command in flow record configuration mode. To disable the use the application fields as a key field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The application version field is not configured as a nonkey field.
Release |
Modification |
---|---|
Cisco IOS XE Release 3.7S |
This command was introduced. |
The fields collected by this command can only extracted using the IPFIX export protocol.
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the SMTP application server as a nonkey field for Flexible Netflow:
Router(config)# flow record RECORD-1 Router(config-flow-record)# collect application smtp server
The following example configures the SMTP application server as a nonkey field for Performance Monitor:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect application smtp server
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the application vendor field as a nonkey field for a flow record, use the collect application vendor command in flow record configuration mode. To disable the use the application fields as a key field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The application vendor field is not configured as a nonkey field.
Release |
Modification |
---|---|
15.2(3)T |
This command was introduced. |
Cisco IOS XE Release 3.6S. |
This command was integrated into Cisco IOS XE Release 3.6S. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the application vendor as a nonkey field for Performance Monitor:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect application vendor
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the application version field as a nonkey field for a flow record, use the collect application version command in flow record configuration mode. To disable the use the application fields as a key field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The application version field is not configured as a nonkey field.
Release |
Modification |
---|---|
15.2(3)T |
This command was introduced. |
Cisco IOS XE Release 3.6S. |
This command was integrated into Cisco IOS XE Release 3.6S. |
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the application version as a nonkey field for Performance Monitor:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect application version
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure various connection information fields as a nonkey field for a flow record, use the collect connection command in flow record configuration mode. To disable the use of the connection information fields as a nonkey field for a flow record, use the no form of this command.
initiator |
Configures information about the direction of the flow as a nonkey field. |
new-translations |
Configures the number of TCP or UDP connections which were opened during an observation period as a nonkey field. |
sum-duration |
Configures the total time in seconds for all of the TCP or UDP connections which were in use during an observation period as a nonkey field. |
Connection information fields are not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE 3.4S |
This command was introduced. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The initiator keyword provides the following information about the direction of the flow.
For the new-translations and sum-duration keywords, the observation period can be specified by the start and end timestamps for the flow.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures information about the direction of the flow as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect connections initiator
The following example configures information about the direction of the flow as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect connections initiator
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one of the connection client fields as a nonkey field for a flow record, use the collect connection client command in flow record configuration mode. To disable the use of one of the connection client fields as a nonkey field for a flow record, use the no form of this command.
counter |
Configures one of client connection counter fields, as a nonkey field. |
bytes long |
Configures the client connection bytes long counter field, as a nonkey field. |
packets long |
Configures the client connection packets long counter field, as a nonkey field. |
packets retransmitted |
Configures the client connection packets retransmitted field, as a nonkey field. |
ipv4 address |
Configures the client connection ipv4 address field, as a nonkey field. |
ipv6 address |
Configures the client connection ipv6 address field, as a nonkey field. |
transport port |
Configures the client connection transport port field, as a nonkey field. |
The connection client fields are not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field for the connection client IPv6 address, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection client ipv6 address
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one of the connection application delay fields as a nonkey field for a flow record, use the collect connection delay application command in flow record configuration mode. To disable the use of one of the connection application delay field as a nonkey field for a flow record, use the no form of this command.
application |
Configures the field for the application delay, as a nonkey field. |
max |
Configures the field for the maximum amount of network delay, as a nonkey field. |
min |
Configures the field for the minimum amount of network delay, as a nonkey field. |
sum |
Configures the field for the total amount of network delay, as a nonkey field. |
The connection application delay fields are not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field that counts the total amount of application delay, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection delay application sum
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one of the connection network delay fields as a nonkey field for a flow record, use the collect connection delay network command in flow record configuration mode. To disable the use of one of the connection network delay field as a nonkey field for a flow record, use the no form of this command.
client-to-server |
Configures the field for the client-to-server network delay, as a nonkey field. |
to-client |
Configures the field for the to-client network delay, from the responder, as a nonkey field. |
to-server |
Configures the field for the to-server network delay, as a nonkey field. |
max |
Configures the field for the maximum amount of network delay, as a nonkey field. |
min |
Configures the field for the minimum amount of network delay, as a nonkey field. |
sum |
Configures the field for the total amount of network delay, as a nonkey field. |
The connection network delay fields are not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field that counts the total amount of client-to-server network delay, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection delay network client-to-server sum
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one of the connection response delay fields as a nonkey field for a flow record, use the collect connection delay response command in flow record configuration mode. To disable the use of one of the connection response delay fields as a nonkey field for a flow record, use the no form of this command.
client-to-server |
Configures the field for the client-to-server response delay, as a nonkey field. |
to-server |
Configures the field for the to-server response delay, from the responder, as a nonkey field. |
histogram |
Configures the field for the to-server response delay histogram, as a nonkey field. |
max |
Configures the field for the maximum amount of response delay, as a nonkey field. |
min |
Configures the field for the minimum amount of response delay, as a nonkey field. |
sum |
Configures the field for the total amount of response delay, as a nonkey field. |
late |
Configures the field for the late to-server response delay histogram, as a nonkey field. |
The connection response delay fields are not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field that counts the total amount of client-to-server response delay, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection delay response client-to-server sum
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one of the connection performance application-delay fields as a nonkey field for a flow record, use the collect connection performance application-delay command in flow record configuration mode. To disable the use of one of the application-delay fields as a nonkey field for a flow record, use the no form of this command.
max |
Configures the field for the maximum amount of network delay, as a nonkey field. |
min |
Configures the field for the minimum amount of network delay, as a nonkey field. |
sum |
Configures the field for the total amount of network delay, as a nonkey field. |
The connection performance application-delay field is not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field that counts the total amount of application-delay, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection performance responder application-delay sum
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one of the connection performance initiator fields as a nonkey field for a flow record, use the collect connection performance initiator command in flow record configuration mode. To disable the use of one of the application media field as a nonkey field for a flow record, use the no form of this command.
bytes long |
Configures the field for the total number of layer 4 payload bytes in a flow from the initiator, as a nonkey field. |
count late-responses |
Configures the field that counts the total number of late responses collected from the initiator, as a nonkey field. |
network-delay max |
Configures the field for the maximum amount of network delay from a initiator, as a nonkey field. |
network-delay min |
Configures the field for the minimum amount of network delay from a initiator, as a nonkey field. |
network-delay sum |
Configures the field for the total amount of network delay from a initiator, as a nonkey field. |
packets long |
Configures the field for the long packet count in a flow from the initiator, as a nonkey field. |
The connection performance initiator field is not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field that counts the total number of late responses collected from the initiator, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection performance initiator count late-responses
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one of the connection performance network-delay fields as a nonkey field for a flow record, use the collect connection performance network-delay command in flow record configuration mode. To disable the use of one of the performance network-delay fields as a nonkey field for a flow record, use the no form of this command.
max |
Configures the field for the maximum amount of network delay, as a nonkey field. |
min |
Configures the field for the minimum amount of network delay, as a nonkey field. |
sum |
Configures the field for the total amount of network delay, as a nonkey field. |
The connection performance network-delay field is not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field that counts the total amount of network-delay, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection performance responder network-delay sum
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one of the connection performance new-transaction fields as a nonkey field for a flow record, use the collect connection performance new-transaction command in flow record configuration mode. To disable the use of one of the performance new-transaction fields as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The connection performance new-transaction field is not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field that counts the total amount of new-transaction, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection performance responder new-transaction
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one of the connection performance responder fields as a nonkey field for a flow record, use the collect connection performance responder command in flow record configuration mode. To disable the use of one of the application media field as a nonkey field for a flow record, use the no form of this command.
bytes long |
Configures the field for the total number of layer 4 payload bytes in a flow from the responder, as a nonkey field. |
count histogram bucket # |
Configures the field that counts the total number of histograms collected , in the specified bucket number, from the responder, as a nonkey field. |
count late-responses |
Configures the field that counts the total number of late responses collected from the responder, as a nonkey field. |
count responses |
Configures the field that counts the total number of responses collected from the responder, as a nonkey field. |
network-delay max |
Configures the field for the maximum amount of network delay from a responder, as a nonkey field. |
network-delay min |
Configures the field for the minimum amount of network delay from a responder, as a nonkey field. |
network-delay sum |
Configures the field for the total amount of network delay from a responder, as a nonkey field. |
packets long |
Configures the field for the long packet count in a flow from the responder, as a nonkey field. |
response-time max |
Configures the field for the maximum amount of response time from a responder, field as a nonkey field. |
response-time min |
Configures the field for the minimum amount of response time from a responder, field as a nonkey field. |
response-time sum |
Configures the field for the total amount of response time from a responder, field as a nonkey field. |
The connection performance responder field is not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field that counts the total number of late responses collected from the responder, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection performance responder count late-responses
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one of the connection performance total-delay fields as a nonkey field for a flow record, use the collect connection performance total-delay command in flow record configuration mode. To disable the use of one of the performance total-delay fields as a nonkey field for a flow record, use the no form of this command.
max |
Configures the field for the maximum amount of network delay, as a nonkey field. |
min |
Configures the field for the minimum amount of network delay, as a nonkey field. |
sum |
Configures the field for the total amount of network delay, as a nonkey field. |
The connection performance total-delay field is not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field that counts the total amount of total-delay, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection performance responder total-delay sum
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one of the connection performance total-transaction-time fields as a nonkey field for a flow record, use the collect connection performance total-transaction-time command in flow record configuration mode. To disable the use of one of the performance total-transaction-time fields as a nonkey field for a flow record, use the no form of this command.
max |
Configures the field for the maximum amount of network delay, as a nonkey field. |
min |
Configures the field for the minimum amount of network delay, as a nonkey field. |
sum |
Configures the field for the total amount of network delay, as a nonkey field. |
The connection performance total-transaction-time field is not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field that counts the total amount of total-transaction-time, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection performance responder total-transaction-time sum
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one of the connection server fields as a nonkey field for a flow record, use the collect connection server command in flow record configuration mode. To disable the use of one of the connection server fields as a nonkey field for a flow record, use the no form of this command.
counter |
Configures one of server connection counter fields, as a nonkey field. |
bytes long |
Configures the server connection bytes long counter field, as a nonkey field. |
packets long |
Configures the server connection packets long counter field, as a nonkey field. |
packets retransmitted |
Configures the server connection packets retransmitted field, as a nonkey field. |
ipv4 address |
Configures the server connection ipv4 address field, as a nonkey field. |
ipv6 address |
Configures the server connection ipv6 address field, as a nonkey field. |
transport port |
Configures the server connection transport port field, as a nonkey field. |
The connection server fields are not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field for the connection server IPv6 address, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection server ipv6 address
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one of the connection transaction fields as a nonkey field for a flow record, use the collect connection delay application command in flow record configuration mode. To disable the use of one of the connection transaction fields as a nonkey field for a flow record, use the no form of this command.
counter complete |
Configures the field for the connection complete-transaction counter, as a nonkey field. |
duration |
Configures the field for the transaction duration, as a nonkey field. |
max |
Configures the field for the maximum amount of transaction duration, as a nonkey field. |
min |
Configures the field for the minimum amount of transaction duration, as a nonkey field. |
sum |
Configures the field for the total amount of transaction duration, as a nonkey field. |
The connection transaction duration fields are not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field for the total transaction duration, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect connection transaction duration sum
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the number of bytes or packets in a flow as a nonkey field for a Flexible NetFlow flow record, use the collect counter command in Flexible NetFlow flow record configuration mode. To disable the use of the number of bytes or packets in a flow (counters) as a nonkey field for a Flexible NetFlow flow record, use the no form of this command.
bytes |
Configures the number of bytes seen in a flow as a nonkey field and enables collecting the total number of bytes from the flow. |
long |
(Optional) Enables collecting the total number of bytes or packets from the flow using a 64-bit counter rather than a 32-bit counter. |
replicated |
Total number of replicated (multicast) IPv4 packets. |
squared long |
(Optional) Enables collecting the total of the square of the number of bytes from the flow. |
packets |
Configures the number of packets seen in a flow as a nonkey field and enables collecting the total number of packets from the flow. |
rate |
Configures the byte rate counter as a nonkey field. |
dropped |
Configures the dropped packet counter as a nonkey field. |
The number of bytes or packets in a flow is not configured as a nonkey field.
Flexible NetFlow flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
Support for this command was added for Cisco 7200 series routers in Cisco IOS Release 12.2(33)SRC. |
12.4(22)T |
The replicated keyword was added. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
15.1(3)T |
This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor without the replicated and squared longkeywords and with the addition of the rate and droppedkeywords. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor without the replicated and squared longkeywords and with the addition of the rate and droppedkeywords. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.
The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE
The rate and droppedkeywords were added and the replicated and squared longkeywords are not available. You must first enter the flow record type performance-monitor command.
collect counter bytes
This command configures a 32-bit counter for the number of bytes seen in a flow.
collect counter packets
This command configures a 32-bit counter that is incremented for each packet seen in the flow. For extremely long flows it is possible for this counter to restart at 0 (wrap) when it reaches the limit of approximately 4 billion packets. On detection of a situation that would cause this counter to restart at 0, a flow monitor with a normal cache type exports the flow and starts a new flow.
collect counter packets long
This command configures a 64-bit counter that will be incremented for each packet seen in the flow. It is unlikely that a 64-bit counter will ever restart at 0.
collect counter bytes squared long
This counter can be used in conjunction with the byte and packet counters in order to calculate the variance of the packet sizes. Its value is derived from squaring each of the packet sizes in the flow and adding the results. This value can be used as part of a standard variance function.
The variance and standard deviation of the packet sizes for the flow can be calculated with the following formulas:
cbs: value from the counter bytes squared field
pkts: value from the counter packets field
bytes: value from the counter bytes field
Variance = (cbs/pkts) - (bytes/pkts)2
Standard deviation = square root of Variance
Example 1:
Packet sizes of the flow: 100, 100, 100, 100
Counter packets: 4
Counter bytes: 400, mean packet size = 100
Counter bytes squared: 40,000
Variance = (40,000/4) - (400/4)2 = 0
Standard Deviation = 0
Size = 100 +/- 0
Example 2:
Packet sizes of the flow: 50, 150, 50, 150
Counter packets: 4
Counter bytes: 400, mean packet size = 100
Counter bytes squared: 50,000
Variance = (50,000/4) - (400/4)2 = 2500
Standard deviation = 50
Size = 100 +/- 50
The following example configures the total number of bytes in the flows as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect counter bytes
The following example configures the total number of bytes in the flows as a nonkey field using a 64-bit counter:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect counter bytes long
The following example configures the sum of the number of bytes of each packet in the flow squared as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect counter bytes squared long
The following example configures the total number of packets from the flows as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect counter packets
The following example configures the total number of packets from the flows as a nonkey field using a 64-bit counter:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect counter packets long
The following example configuresthe total number of packets from the flows as a nonkey field using a 64-bit counter:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect counter packets long
Command |
Description |
---|---|
flow record |
Creates a flow record for Flexible NetFlow. |
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the use of destination VLAN ID as a nonkey field for a flow record, use the collectdatalinkdestination-vlan-id command in flow record configuration mode. To disable the use of destination VLAN ID as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
Destination VLAN ID addresses are not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
You must first enter the flow record type performance-monitorcommand before you can use this command. This command cannot be used with Flexible NetFlow.
The collectcommands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the use of the destination VLAN ID as a nonkey field for a Performance Monitor flow record:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect datalink destination-vlan-id output
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the use of MAC addresses as a nonkey field for a Flexible NetFlow flow record, use the collectdatalinkmac command in Flexible NetFlow flow record configuration mode. To disable the use of Layer 2 MAC addresses as a non-key field for a Flexible NetFlow flow record, use the no form of this command.
destination address |
Configures the use of the destination MAC address as a non-key field. |
source address |
Configures the use of the source MAC address as a non-key field. |
input |
Packets received by the router. |
output |
Packets transmitted by the router. |
MAC addresses are not configured as a nonkey field.
Flexible NetFlow flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(22)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into 15.2(2)T without the destination keyword for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitorcommand before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The input and output keywords of the collectdatalinkmac command are used to specify the observation point that is used by the collectdatalinkmac command to capture the MAC addressees from network traffic. For example, when you configure a flow record with the collectdatalinkmacdestinationaddressinputcommand to monitor the simulated denial of service (DoS) attack in the figure below and apply the flow monitor to which the flow record is assigned in either input (ingress) mode on interface Ethernet 0/0.1 on R3 or output (egress) mode on interface Ethernet 1/0.1 on R3, the observation point is always Ethernet 0/0.1 on R3. The destination MAC address that is collected is aaaa.bbbb.cc04.
Figure 5 | Simulated DoS Attack (b) |
When the destination output mac address is configured, the value is the destination mac address of the output packet, even if the monitor the flow record is applied to is input only.
When the destination input mac address is configured, the value is the destination mac address of the input packet, even if the monitor the flow record is applied to is output only.
When the source output mac address is configured, the value is the source mac address of the output packet, even if the monitor the flow record is applied to is input only.
When the source input mac address is configured, the value is the source mac address of the input packet, even if the monitor the flow record is applied to is output only.
The following example configures the use of the destination MAC address of packets that are received by the router as a nonkey field for a Flexible NetFlow flow record:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect datalink mac destination address input
The following example configures the use of the source MAC addresses of packets that are transmitted by the router as a nonkey field for a Flexible NetFlow flow record:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect datalink mac source address output
The following example configures the use of the source MAC addresses of packets that are transmitted by the router as a nonkey field for a Performance Monitor flow record: :
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect datalink mac source address output
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the use of source VLAN ID as a nonkey field for a flow record, use the collectdatalinksource-vlan-id command in flow record configuration mode. To disable the use of source VLAN ID as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
Source VLAN ID addresses are not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
You must first enter the flow record type performance-monitorcommand before you can use this command. This command cannot be used with Flexible NetFlow.
The collectcommands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the use of the source VLAN ID as a nonkey field for a Performance Monitor flow record: :
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect datalink source-vlan-id output
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the use of VLAN as a nonkey field for a flow record, use the collectdatalinkvlan command in flow record configuration mode. To disable the use of VLAN as a nonkey field for a flow record, use the no form of this command.
input |
Packets received by the router. |
output |
Packets transmitted by the router. |
VLAN addresses are not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(22)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into 15.2(2)T without the destination keyword for Cisco Performance Monitor. |
You must first enter the flow record type performance-monitorcommand before you can use this command. This command cannot be used with Flexible NetFlow.
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The input and output keywords are used to specify the observation point that is used by the collectdatalinkvlan command to capture the VLAN from network traffic.
The following example configures the use of the VLAN as a nonkey field for a Performance Monitor flow record: :
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect datalink vlan output
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the flow direction, the flow sampler ID number, or reason why the flow ended as a nonkey field for a flow record, use the collect flow command in flow record configuration mode. To disable the use of the flow direction and the flow sampler ID number as a nonkey field for a flow record, use the no form of this command.
direction |
Configures the flow direction as a nonkey field and enables the collection of the direction in which the flow was monitored. |
sampler |
Configures the flow sampler ID as a nonkey field and enables the collection of the ID of the sampler that is assigned to the flow monitor. |
class |
Configures the flow class as a nonkey field and enables the collection of the ID of the sampler that is assigned to the flow monitor. |
qos-class |
Configures the flow QoS class as a nonkey field and enables the collection of the ID of the sampler that is assigned to the flow monitor. |
The flow direction and the flow sampler ID number are not configured as nonkey fields.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
Support for this command was added for Cisco 7200 series routers in Cisco IOS Release 12.2(33)SRC. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
15.1(4)M1 |
This command was integrated into Cisco IOS Release 15.1(4)M1 with only the direction keyword. |
Cisco IOS XE Release 3.8S |
This command was modified. The qos-class and class keywords were added in Cisco IOS XE Release 3.8S. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.
The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
collect flow direction
This field indicates the direction of the flow. This is of most use when a single flow monitor is configured for input and output flows. It can be used to find and eliminate flows that are being monitored twice, once on input and once on output. This field may also be used to match up pairs of flows in the exported data when the two flows are flowing in opposite directions.
collect flow sampler
This field contains the ID of the flow sampler used to monitor the flow. This is useful when more than one flow sampler is being used with different sampling rates. The flow exporter option sampler-table command exports options records with mappings of the flow sampler ID to sampling rate so the collector can calculate the scaled counters for each flow.
The following example configures the ID of the flow sampler that is assigned to the flow as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect flow sampler
The following example configures the direction in which the flow was monitored as a nonkey field:
Router(config)# flow record type performance-monitor FLOW-RECORD-1 Router(config-flow-record)# collect flow direction
Command |
Description |
---|---|
flow exporter |
Creates a flow exporter |
flow record |
Creates a flow record for Flexible NetFlow. |
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the input and output interface as a nonkey field for a flow record, use the collect interface command in flow record configuration mode. To disable the use of the input and output interface as a nonkey field for a flow record, use the no form of this command.
input |
Configures the input interface as a nonkey field and enables collecting the input interface from the flows. |
output |
Configures the output interface as a nonkey field and enables collecting the output interface from the flows. |
The input and output interface is not configured as a nonkey field.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
This command was integrated into Cisco IOS Release 12.2(33)SRC and implemented on the Cisco 7200 series routers. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
15.1(3)T |
This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.
The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE
You must first enter the flow record type performance-monitor command.
The following example configures the input interface as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect interface input
The following example configures the output interface as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect interface output
The following example configures the input interface as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect interface input
Command |
Description |
---|---|
flow record |
Creates a flow record for Flexible NetFlow. |
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one or more of the IPv4 fields as a nonkey field for a flow record, use the collect ipv4 command in flow record configuration mode. To disable the use of one or more of the IPv4 fields as a nonkey field for a flow record, use the no form of this command.
dscp |
Configures the differentiated services code point (DCSP) field as a nonkey field and enables collecting the value in the IPv4 DSCP type of service (ToS) fields from the flows. |
header-length |
Configures the IPv4 header length flag as a nonkey field and enables collecting the value in the IPv4 header length (in 32-bit words) field from the flows. |
id |
Configures the IPv4 ID flag as a nonkey field and enables collecting the value in the IPv4 ID field from the flows. |
option map |
Configures the IPv4 options flag as a nonkey field and enables collecting the value in the bitmap representing which IPv4 options have been seen in the options field from the flows. |
precedence |
Configures the IPv4 precedence flag as a nonkey field and enables collecting the value in the IPv4 precedence (part of ToS) field from the flows. |
protocol |
Configures the IPv4 payload protocol field as a nonkey field and enables collecting the IPv4 value of the payload protocol field for the payload in the flows |
tos |
Configures the ToS field as a nonkey field and enables collecting the value in the IPv4 ToS field from the flows. |
version |
Configures the version field as a nonkey field and enables collecting the value in the IPv4 version field from the flows. |
The IPv4 fields are not configured as a nonkey field.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
This command was integrated into Cisco IOS Release 12.2(33)SRC and implemented on the Cisco 7200 series routers. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
15.1(3)T |
This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor with only the dscp keyword. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor with only the dscp keyword. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.
The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
![]() Note |
Some of the keywords of the collect ipv4 command are documented as separate commands. All of the keywords for the collect ipv4 command that are documented separately start with collect ipv4. For example, for information about configuring the IPv4 time-to-live (TTL) field as a nonkey field and collecting its value for a flow record, refer to the collect ipv4 ttl command. |
Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE
Only the the dscp keyword is available. You must first enter the flow record type performance-monitor command.
The following example configures the DSCP field as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv4 dscp
The following example configures the DSCP field as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv4 dscp
Command |
Description |
---|---|
flow record |
Creates a flow record for Flexible NetFlow. |
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the IPv4 destination address as a nonkey field for a flow record, use the collect ipv4 destination command in flow record configuration mode. To disable the use of an IPv4 destination address field as a nonkey field for a flow record, use the no form of this command.
address |
Configures the IPv4 destination address as a nonkey field and enables collecting the value of the IPv4 destination address from the flows. |
mask |
Configures the IPv4 destination address mask as a nonkey field and enables collecting the value of the IPv4 destination address mask from the flows. |
prefix |
Configures the prefix for the IPv4 destination address as a nonkey field and enables collecting the value of the IPv4 destination address prefix from the flows. |
minimum-mask mask |
(Optional) Specifies the size, in bits, of the minimum mask. Range: 1 to 32. |
The IPv4 destination address is not configured as a nonkey field.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
This command was integrated into Cisco IOS Release 12.2(33)SRC and implemented on the Cisco 7200 series routers. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
15.1(3)T |
This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor with only the maskand minimum-maskkeywords. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor with only the maskand minimum-maskkeywords. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.
The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE
Only the maskand minimum-maskkeywords are available. You must first enter the flow record type performance-monitor command.
The following example configures the IPv4 destination address prefix from the flows that have a prefix of 16 bits as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv4 destination prefix minimum-mask 16
The following example configures the IPv4 destination address prefix from the flows that have a prefix of 16 bits as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv4 destination prefix minimum-mask 16
Command |
Description |
---|---|
flow record |
Creates a flow record for Flexible NetFlow. |
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the IPv4 fragmentation flags and the IPv4 fragmentation offset as a nonkey field for a flow record, use the collect ipv4 fragmentation command in flow record configuration mode. To disable the use of the IPv4 fragmentation flags and the IPv4 fragmentation offset as a nonkey field for a flow record, use the no form of this command.
flags |
Configures the IPv4 fragmentation flags as a nonkey field and enables collecting the value in the IPv4 fragmentation flag fields from the flows. |
offset |
Configures the IPv4 fragmentation offset value as a nonkey field and enables collecting the value in the IPv4 fragmentation offset field from the flows. |
The IPv4 fragmentation flags and the IPv4 fragmentation offset are not configured as nonkey fields.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
Support for this command was added for Cisco 7200 series routers in Cisco IOS Release 12.2(33)SRC. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
collect ipv4 fragmentation flags
This field collects the "don't fragment" and "more fragments" flags.
Bit 0: reserved, must be zero.
Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment
Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments
Bits 3-7: (DC) Don't Care, value is irrelevant
0 1 2 3 4 5 6 7 +---+---+---+---+---+---+---+---+ | | D | M | D | D | D | D | D | | 0 | F | F | C | C | C | C | C | +---+---+---+---+---+---+---+---+
For more information on IPv4 fragmentation flags, see RFC 791 Internet Protocol at the following URL: http://www.ietf.org/rfc/rfc791.txt .
The following example configures the IPv4 fragmentation flags as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv4 fragmentation flags
The following example configures the IPv4 fragmentation flags as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv4 fragmentation flags
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the IPv4 initiator address field as a nonkey field for a flow record, use the collect ipv4 initiator command in flow record configuration mode. To disable the use of one or more of the IPv4 initiator address field as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The IPv4 initiator address field is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
You must first enter the flow record type performance-monitorcommand before you can use this command. This command cannot be used with Flexible NetFlow.
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the IPv4 initiator address field as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv4 initiator address
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the IPv4 responder address field as a nonkey field for a flow record, use the collect ipv4 responder command in flow record configuration mode. To disable the use of one or more of the IPv4 responder address field as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The IPv4 responder address field is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
You must first enter the flow record type performance-monitorcommand before you can use this command. This command cannot be used with Flexible NetFlow.
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the IPv4 initiator address field as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv4 responder address
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure a section of an IPv4 packet as a nonkey field for a flow record, use the collect ipv4 section command in flow record configuration mode. To disable the use of a section of an IPv4 packet as a nonkey field for a flow record, use the no form of this command.
header size header-size |
Configures the number of bytes of raw data starting at the IPv4 header to use as a nonkey field, and enables collecting the value in the raw data from the flows. Range: 1 to 1200. |
payload size payload-size |
Configures the number of bytes of raw data starting at the IPv4 payload to use as a nonkey field, and enables collecting the value in the raw data from the flows. Range: 1 to 1200. |
A section of an IPv4 packet is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
Support for this command was added for Cisco 7200 series routers in Cisco IOS Release 12.2(33)SRC. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
It is recommended that you configure both header size and payload size so that you know how much data is going to be captured.
collect ipv4 section header
This command causes the first IPv4 header to be copied into the flow record for this flow. Only the configured size in bytes will be copied and part of the payload will also be captured if the configured size is larger than the size of the header.
![]() Note |
This command can result in large records which use a lot of router memory and export bandwidth. |
collect ipv4 section payload
This command results in a copy of the first IPv4 payload being put into the flow record for this flow. Only the configured size in bytes will be copied and may end in a series of 0's if the configured size is greater than the size of the payload.
![]() Note |
This command can result in large records which use a lot of router memory and export bandwidth. |
The following example configures the first eight bytes from the IP header of the packets in the flows as a non-key field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv4 section header size 8
The following example configures the first 16 bytes from the payload of the packets in the flows as a non-key field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv4 section payload size 16
The following example configures the first 16 bytes from the payload of the packets in the flows as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv4 section payload size 16
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the IPv4 source address as a nonkey field for a flow record, use the collect ipv4 source command in flow record configuration mode. To disable the use of the IPv4 source address field as a nonkey field for a flow record, use the no form of this command.
address |
Configures the IPv4 source address as a nonkey field and enables collecting the value of the IPv4 source address from the flows. |
mask |
Configures the IPv4 source address mask as a nonkey field and enables collecting the value of the IPv4 source address mask from the flows. |
prefix |
Configures the prefix for the IPv4 source address as a nonkey field and enables collecting the value of the IPv4 source address prefix from the flows. |
minimum-mask mask |
(Optional) Specifies the size, in bits, of the minimum mask. Range: 1 to 32. |
The IPv4 source address is not configured as a nonkey field.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
This command was integrated into Cisco IOS Release 12.2(33)SRC and implemented on the Cisco 7200 series routers. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
15.1(3)T |
This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor with only the maskand minimum-maskkeywords. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor with only the maskand minimum-maskkeywords. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.
The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE
Only the maskand minimum-maskkeywords are available. You must first enter the flow record type performance-monitor command.
collect ipv4 source prefix minimum-mask
The source address prefix is the network part of an IPv4 source address. The optional minimum mask allows more information to be gathered about large networks.
collect ipv4 source mask minimum-mask
The source address mask is the number of bits that make up the network part of the source address. The optional minimum mask allows a minimum value to be configured. This command is useful when there is a minimum mask configured for the source prefix field and the mask is to be used with the prefix. In this case, the values configured for the minimum mask should be the same for the prefix and mask fields.
Alternatively, if the collector is aware of the minimum mask configuration of the prefix field, the mask field can be configured without a minimum mask so that the true mask and prefix can be calculated.
The following example configures the IPv4 source address prefix from the flows that have a prefix of 16 bits as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv4 source prefix minimum-mask 16
The following example configures the IPv4 source address prefix from the flows that have a prefix of 16 bits as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv4 source prefix minimum-mask 16
Command |
Description |
---|---|
flow record |
Creates a flow record for Flexible NetFlow. |
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the IPv4 total-length field as a nonkey field for a flow record, use the collect ipv4 total-length command in flow record configuration mode. To disable the use of the IPv4 total-length field as a nonkey field for a flow record, use the no form of this command.
maximum |
(Optional) Configures the maximum value of the total length field as a nonkey field and enables collecting the maximum value of the total length field from the flows. |
minimum |
(Optional) Configures the minimum value of the total length field as a nonkey field and enables collecting the minimum value of the total length field from the flows. |
The IPv4 total-length field is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
Support for this command was added for Cisco 7200 series routers in Cisco IOS Release 12.2(33)SRC. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
collect ipv4 total-length [minimum | maximum]
This command is used to collect the lowest and highest IPv4 total length values seen in the lifetime of the flow. Configuring this command results in more processing than is needed to simply collect the first total length value seen using the collect ipv4 total-length command.
The following example configures total-length value as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv4 total-length
The following example configures minimum total-length value seen in the flows as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv4 total-length minimum
The following example configures the minimum total-length value seen in the flows as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv4 total-length minimum
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the IPv4 time-to-live (TTL) field as a nonkey field for a flow record, use the collect ipv4 ttl command in flow record configuration mode. To disable the use of the IPv4 TTL field as a nonkey field for a flow record, use the no form of this command.
maximum |
(Optional) Configures the maximum value of the TTL field as a nonkey field and enables collecting the maximum value of the TTL field from the flows. |
minimum |
(Optional) Configures the minimum value of the TTL field as a nonkey field and enables collecting the minimum value of the TTL field from the flows. |
The IPv4 time-to-live (TTL) field is not configured as a nonkey field.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
This command was integrated into Cisco IOS Release 12.2(33)SRC and implemented on the Cisco 7200 series routers. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
15.1(3)T |
This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.
The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE
You must first enter the flow record type performance-monitor command.
collect ipv4 ttl [minimum | maximum]
This command is used to collect the lowest and highest IPv4 TTL values seen in the lifetime of the flow. Configuring this command results in more processing than is needed to simply collect the first TTL value seen using the collect ipv4 ttl command.
The following example configures the largest value for IPv4 TTL seen in the flows as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv4 ttl maximum
The following example configures the smallest value for IPv4 TTL seen in the flows as a nonkey field
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv4 ttl minimum
The following example configures the smallest value for IPv4 TTL seen in the flows as a nonkey field
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv4 ttl minimum
Command |
Description |
---|---|
flow record |
Creates a flow record for Flexible NetFlow. |
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one or more of the IPv6 fields as a nonkey field for a flow record, use the collect ipv6 command in flow record configuration mode. To disable the use of one or more of the IPv6 fields as a nonkey field for a flow record, use the no form of this command.
dscp |
Configures the differentiated services code point (DCSP) field as a nonkey field and enables collecting the value in the IPv6 DSCP type of service (ToS) fields from the flows. |
flow-label |
Configures the IPv6 flow label as a nonkey field and enables collecting the value in the IPv6 flow label from the flows. |
next-header |
Configures the next-header field as a nonkey field and enables collecting the value of the next-header field in the IPv6 header from the flows. |
payload-length |
Configures the length of the IPv6 payload as a nonkey field and enables collecting the number of bytes used for the payload in the flows. |
precedence |
Configures the IPv6 precedence flag as a nonkey field and enables collecting the value in the IPv6 precedence (part of ToS) field from the flows. |
protocol |
Configures the IPv6 payload protocol field as a nonkey field and enables collecting the IPv6 value of the payload protocol field for the payload in the flows. |
traffic-class |
Configures the IPv6 traffic-class field as a nonkey field and enables collecting the value in the IPv6 protocol field from the flows. |
version |
Configures the IPv6 version field as a nonkey field and enables collecting the value in the IPv6 version field from the flows. |
The IPv6 fields are not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(20)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
![]() Note |
Some of the keywords for the collect ipv6 command are documented as separate commands. All of the keywords for the collect ipv6 command that are documented separately start with collect ipv6. For example, for information about configuring the IPv6 hop limit field as a nonkey field and collecting its value for a flow record, refer to the collect ipv6 hop-limit command. |
The following example configures the IPv6 DSCP field as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv6 dscp
The following example configures the IPv6 DSCP field as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv6 dscp
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the IPv6 destination address as a nonkey field for a flow record, use the collect ipv6 destination command in flow record configuration mode. To disable the use of an IPv6 destination address field as a nonkey field for a flow record, use the no form of this command.
address |
Configures the IPv6 destination address as a nonkey field and enables collecting the value of the IPv6 destination address from the flows. |
mask |
Configures the IPv6 destination address mask as a nonkey field and enables collecting the value of the IPv6 destination address mask from the flows. |
prefix |
Configures the prefix for the IPv6 destination address as a nonkey field and enables collecting the value of the IPv6 destination address prefix from the flows. |
minimum-mask mask |
(Optional) Specifies the size, in bits, of the minimum mask. Range: 1 to 128. |
TheIPv6 destination address is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(20)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
12.2(50)SY |
This command was modified. The addressand minimum-mask keywords were not supported in Cisco IOS Release 12.2(50)SY. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the IPv6 destination address prefix from the flows that have a prefix of 16 bits as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv6 destination prefix minimum-mask 16
The following example configures the IPv6 destination address prefix from the flows that have a prefix of 16 bits as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv6 destination prefix minimum-mask 16
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the bitmap of the IPv6 extension header map as a nonkey field for a flow record, use the collect ipv6 extension map command in flow record configuration mode. To disable the use of the IPv6 bitmap of IPv6 extension header map as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The use of the bitmap of the IPv6 extension header map is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(20)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
Bitmap of the IPv6 Extension Header Map
The bitmap of IPv6 extension header map is made up of 32 bits.
0 1 2 3 4 5 6 7 +-----+-----+-----+-----+-----+-----+-----+-----+ | Res | FRA1| RH | FRA0| UNK | Res | HOP | DST | +-----+-----+-----+-----+-----+-----+-----+-----+ 8 9 10 11 12 13 14 15 +-----+-----+-----+-----+-----+-----+-----+-----+ | PAY | AH | ESP | Reserved | +-----+-----+-----+-----+-----+-----+-----+-----+ 16 17 18 19 20 21 22 23 +-----+-----+-----+-----+-----+-----+-----+-----+ | Reserved | +-----+-----+-----+-----+-----+-----+-----+-----+ 24 25 26 27 28 29 30 31 +-----+-----+-----+-----+-----+-----+-----+-----+ | Reserved | +-----+-----+-----+-----+-----+-----+-----+-----+ 0 Res Reserved 1 FRA1 Fragmentation header - not first fragment 2 RH Routing header 3 FRA0 Fragment header - first fragment 4 UNK Unknown Layer 4 header (compressed, encrypted, not supported) 5 Res Reserved 6 HOP Hop-by-hop option header 7 DST Destination option header 8 PAY Payload compression header 9 AH Authentication Header 10 ESP Encrypted security payload 11 to 31 Reserved
For more information on IPv6 headers, refer to RFC 2460 Internet Protocol, Version 6 (IPv6) at the following URL: http://www.ietf.org/rfc/rfc2460.txt .
The following example configures the bitmap of IPv6 extension header map as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv6 extension map
The following example configures the bitmap of IPv6 extension header map as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv6 extension map
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the IPv6 fragmentation fields as a nonkey field for a flow record, use the collect ipv6 fragmentation command in flow record configuration mode. To disable the use one or more of the IPv6 fragmentation fields as a nonkey field for a flow record, use the no form of this command.
flags |
Configures the IPv6 fragmentation flags as a non-key field and enables collecting the value in the IPv6 fragmentation flag fields from the flows. |
id |
Configures the IPv6 fragmentation ID as a non-key field and enables collecting the value in the IPv6 fragmentation id fields from the flows |
offset |
Configures the IPv6 fragmentation offset as a non-key field and enables collecting the value in the IPv6 fragmentation offset field from the flows. |
The use of one or more of the IPv6 fragmentation fields is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(20)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the IPv6 fragmentation flags field as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv6 fragmentation flags
The following example configures the IPv6 fragmentation flags field as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv6 fragmentation flags
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the IPv6 hop limit as a nonkey field for a flow record, use the collect ipv6 hop-limit command in flow record configuration mode. To disable the use of the IPv6 hop limit field as a nonkey field for a flow record, use the no form of this command.
maximum |
(Optional) Configures the IPv6 maximum hop limit as a nonkey field and enables collecting the value of the IPv6 maximum hop limit from the flows. |
minimum |
(Optional) Configures the IPv6 minimum hop limit as a nonkey field and enables collecting the value of the IPv6 minimum hop limit from the flows. |
The IPv6 hop limit is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(20)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
collect ipv6 hop-limit [minimum | maximum]
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
This command is used to collect the lowest and highest IPv6 hop limit values seen in the lifetime of the flow. Configuring this command results in more processing than is needed to simply collect the first hop limit value seen using the collect ipv6 hop-limit command.
The following example configures the IPv6 maximum hop limit from the flows as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv6 hop-limit maximum
The following example configures the IPv6 maximum hop limit from the flows as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv6 hop-limit maximum
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the IPv6 initiator address field as a nonkey field for a flow record, use the collect ipv6 initiator command in flow record configuration mode. To disable the use of one or more of the IPv6 initiator address field as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The IPv6 fields are not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the IPv6 initiator address field as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv6 initiator address
The following example configures the IPv6 initiator address field as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv6 initiator address
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the IPv6 length fields as a nonkey field for a flow record, use the collect ipv6 lengthcommand in flow record configuration mode. To disable the use of one or more of the IPv6 length fields as a nonkey field for a flow record, use the no form of this command.
header |
Configures the length in bytes of the IPv6 header, not including any extension headers, as a nonkey field and collects the value of it for a flow record. |
payload |
Configures the length in bytes of the IPv6 payload, including any extension headers, as a nonkey field and collects the value of it for a flow record. |
total |
Configures the total length in bytes of the IPv6 header and payload as a nonkey field and collects the value of it for a flow record. |
maximum |
(Optional) Configures the maximum total length in bytes of the IPv6 header and payload as a nonkey field and collects the value of it for a flow record. |
minimum |
(Optional) Configures the minimum total length in bytes of the IPv6 header and payload as a nonkey field and collects the value of it for a flow record. |
The IPv6 length fields are not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(20)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
collect ipv6 length [minimum | maximum]
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
This command is used to collect the lowest and highest IPv6 length values seen in the lifetime of the flow. Configuring this command results in more processing than is needed to simply collect the length value seen using the collect ipv6 length command.
The following example configures the length of the IPv6 header, not including any extension headers, in bytes as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv6 length header
The following example configures the length of the IPv6 header, not including any extension headers, in bytes as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv6 length header
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the IPv6 responder address field as a nonkey field for a flow record, use the collect ipv6 responder command in flow record configuration mode. To disable the use of one or more of the IPv6 responder address field as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The IPv6 fields are not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the IPv6 responder address field as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv6 responder address
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure a section of an IPv6 packet as a nonkey field for a flow record, use the collect ipv6 section command in flow record configuration mode. To disable the use of a section of an IPv6 packet as a nonkey field for a flow record, use the no form of this command.
header size header-size |
Configures the number of bytes of raw data, starting at the IPv6 header, to use as a nonkey field, and enables collecting the value in the raw data from the flows. Range: 1 to 1200. |
payload size payload-size |
Configures the number of bytes of raw data, starting at the IPv6 payload, to use as a nonkey field, and enables collecting the value in the raw data from the flows. Range: 1 to 1200. |
A section of an IPv6 packet is not configured as a non-key field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(20)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
It is recommended that you configure both header size and payload size so that you know how much data is going to be captured.
![]() Note |
The IPv6 payload data is captured only if the first packet in the flow is an IPv6 packet. If the first packet in the flow is not an IPv6 packet, information from other packets in the flow such as packet and byte counters, is still captured. |
collect ipv6 section header
This command causes a copy of the first IPv6 header to be put into the flow record for this flow. Only the configured size in bytes will be copied, and part of the payload will also be captured if the configured size is larger than the size of the header.
![]() Note |
Configuring this command can result in large records that use a lot of router memory and export bandwidth. |
collect ipv6 section payload
This command causes a copy of the first IPv6 payload to be put into the flow record for this flow. Only the configured size in bytes will be copied, and it may end in a series of zeros if the configured size is smaller than the size of the payload.
![]() Note |
Configuring this command can result in large records that use a lot of router memory and export bandwidth. |
The following example configures the first eight bytes from the IPv6 header of the packets in the flows as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv6 section header size 8
The following example configures the first 16 bytes from the payload of the IPv6 packets in the flows as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv6 section payload size 16
The following example configures the first 16 bytes from the payload of the IPv6 packets in the flows as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv6 section payload size 16
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the IPv6 source address as a nonkey field for a flow record, use the collect ipv6 source command in flow record configuration mode. To disable the use of the IPv6 source address field as a nonkey field for a flow record, use the no form of this command.
address |
Configures the IPv6 source address as a nonkey field and enables collecting the value of the IPv6 source address from the flows. |
mask |
Configures the IPv6 source address mask as a nonkey field and enables collecting the value of the IPv6 source address mask from the flows. |
prefix |
Configures the prefix for the IPv6 source address as a nonkey field and enables collecting the value of the IPv6 source address prefix from the flows. |
minimum-mask mask |
(Optional) Specifies the size, in bits, of the minimum mask. Range: 1 to 128. |
The IPv6 source address is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(20)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
12.2(50)SY |
This command was modified. The addressand minimum-mask keywords were not supported in Cisco IOS Release 12.2(50)SY. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
collect IPv6 source prefix minimum mask
The source address prefix field is the network part of the source address. The optional minimum mask allows more information to be gathered about large networks.
collect IPv6 source mask minimum mask
The source address mask is the number of bits that make up the network part of the source address. The optional minimum mask allows a minimum value to be configured. This command is useful when there is a minimum mask configured for the source prefix field and the mask is to be used with the prefix. In this case, the values configured for the minimum mask should be the same for the prefix and mask fields.
Alternatively, if the collector is aware of the minimum mask configuration of the prefix field, the mask field can be configured without a minimum mask so that the true mask and prefix can be calculated.
The following example configures the IPv6 source address prefix from the flows that have a prefix of 16 bits as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect ipv6 source prefix minimum-mask 16
The following example configures the IPv6 source address prefix from the flows that have a prefix of 16 bits as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect ipv6 source prefix minimum-mask 16
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the metadata fields as a nonkey field for a flow record, use the collect metadata command in flow record configuration mode. To disable the use the metadata fields as a key field for a flow record, use the no form of this command.
global-session-id |
Configured the name used by the media monitoring system to maintain tracking of a flow end to end as a nonkey filed and enables collecting the value in the global session ID field from the flows. |
multi-party-session-id |
Configured the name used by the media monitoring system to track related flows of a media session end to end as a nonkey field and enables collecting the value in the multiparty session field from the flows. |
The metadata fields are not configured as nonkey fields.
Release |
Modification |
---|---|
15.2(2)S |
This command was introduced. |
15.2(3)T |
This command was integrated into Cisco IOS Release 15.2(3)T. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the global session ID of an end-to-end flow as a nonkey field for Flexible Netflow:
Router(config)# flow record RECORD-1 Router(config-flow-record)# collect metadata global-session-id
The following example configures the global session ID of an end-to-end flow as a nonkey field for Performance Monitor:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect metadata global-session-id
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the monitor event field as a nonkey field for a flow record, use the collect monitor event command in flow record configuration mode. To disable the use of a monitor event field as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The monitor event field is not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
Monitor events are recorded using two bits. Bit 1 is not used. Bit 2 indicates that no media application packets were seen, in other words, a Media Stop Event occured.
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the monitor event field as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect monitor event
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the classification hierarchy of the performance monitor policy as a nonkey field for a flow record, use the collect policy performance-monitorcommand in flow record configuration mode. To disable the use of this nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
Classification hierarchy of the performance monitor policy is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release XE 3.8S |
This command was introduced. |
You must first enter the flow record type performance-monitorcommand before you can use this command. This command cannot be used with Flexible NetFlow.
Because the mode prompt is the same for Flexible NetFlow and Performance Monitor, the command mode for both products is referred to as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the use of the classification hierarchy of the performance monitor policy as a nonkey field for a Flexible NetFlow flow record:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect policy performance-monitor classification hierarchy
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the routing attributes as a nonkey field for a flow record, use the collect routing command in flow record configuration mode. To disable the use of one or more of the routing attributes as a nonkey field for a flow record, use the no form of this command.
destination |
Configures one or more of the destination routing attributes fields as a nonkey field and enables collecting the values from the flows. |
source |
Configures one or more of the source routing attributes fields as a nonkey field and enables collecting the values from the flows. |
as |
Configures the autonomous system field as a nonkey field and enables collecting the value in the autonomous system field from the flows. |
4-octet |
(Optional) Configures the 32-bit autonomous system number as a nonkey field. |
peer |
(Optional) Configures the autonomous system number of the peer network as a nonkey field and enables collecting the value of the autonomous system number of the peer network from the flows. |
traffic-index |
Configures the Border Gateway Protocol (BGP) source or destination traffic index as a nonkey field and enables collecting the value of the BGP destination traffic index from the flows. |
forwarding-status |
Configures the forwarding status as a nonkey field and enables collecting the value of the forwarding status of the packet from the flows. |
next-hop address |
Configures the next-hop address value as a nonkey field and enables collecting information regarding the next hop from the flows. The type of address (IPv4 or IPv6) is determined by the next keyword entered. |
ipv4 |
Specifies that the next-hop address value is an IPv4 address. |
ipv6 |
Specifies that the next-hop address value is an IPv6 address. |
bgp |
(Optional) Configures the IP address of the next hop BGP network as a nonkey field and enables collecting the value of the IP address of the BGP next hop network from the flows. |
vrf input |
Configures the Virtual Routing and Forwarding (VRF) ID for incoming packets as a nonkey field. |
reason |
Configures the reason for the forwarding status as a nonkey field. |
vrf output |
Configures the Virtual Routing and Forwarding (VRF) ID for outgoing packets as a nonkey field. |
The routing attributes are not configured as a nonkey field.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
This command was integrated into Cisco IOS Release 12.2(33)SRC and implemented on the Cisco 7200 series routers. |
12.4(20)T |
This command was modified. The ipv6 keyword was added. |
15.0(1)M |
This command was modified. The vrf inputkeywords were added. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
Cisco IOS XE Release 3.2S |
This command was modified. The 4-octet keyword was added. |
15.1(3)T |
This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor with only the forwarding-statuskeyword and the addition of the reason keyword. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor with only the forwarding-statuskeyword and the addition of the reason keyword. |
Cisco IOS XE Release 3.8S |
This command was modified. The vrf output keyword was added for Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode. For Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode. Here we refer to them both as flow record configuration mode.
The Flexible NetFlow and Performance Monitor collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE
The reason keywordwas added and only the forwarding-statu s keyword is available. You must first enter the flow record type performance-monitor command.
collect routing source as [peer]
This command collects the 16-bit autonomous system number based on a lookup of the router's routing table using the source IP address. The optional peer keyword provides the expected next network, as opposed to the originating network.
collect routing source as 4-octet [peer 4-octet]
This command collects the 32-bit autonomous system number based on a lookup of the router's routing table using the source IP address. The optional peer keyword provides the expected next network, as opposed to the originating network.
collect routing destination as [peer]
This command collects the 16-bit autonomous system number based on a lookup of the router's routing table using the destination IP address. The optional peer keyword provides the expected next network as opposed to the destination network.
collect routing destination as 4-octet [peer 4-octet]
This command collects the 32-bit autonomous system number based on a lookup of the router's routing table using the destination IP address. The peer keyword will provide the expected next network as opposed to the destination network.
collect routing destination traffic-index
This command collects the traffic-index field based on the destination autonomous system for this flow. The traffic-index field is a value propagated through BGP.
This command is not supported for IPv6.
collect routing source traffic-index
This command collects the traffic-index field based on the source autonomous system for this flow. The traffic-index field is a value propagated through BGP.
This command is not supported for IPv6.
collect routing forwarding-status
This command collects a field to indicate if the packets were successfully forwarded. The field is in two parts and may be up to 4 bytes in length. For the releases specified in the Command History table, only the status field is used:
+-+-+-+-+-+-+-+-+ | S | Reason | | t | codes | | a | or | | t | flags | | u | | | s | | +-+-+-+-+-+-+-+-+ 0 1 2 3 4 5 6 7 Status: 00b=Unknown, 01b = Forwarded, 10b = Dropped, 11b = Consumed
collect routing vrf input
This command collects the VRF ID from incoming packets on a router. In the case where VRFs are associated with an interface via methods such as VRF Selection Using Policy Based Routing/Source IP Address, a VRF ID of 0 will be recorded. If a packet arrives on an interface that does not belong to a VRF, a VRF ID of 0 is recorded.
The following example configures the 16-bit autonomous system number based on a lookup of the router's routing table using the source IP address as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect routing source as
The following example configures the 16-bit autonomous system number based on a lookup of the router's routing table using the destination IP address as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect routing destination as
The following example configures the value in the traffic-index field based on the source autonomous system for a flow as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect routing source traffic-index
The following example configures the forwarding status as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect routing forwarding-status
The following example configures the VRF ID for incoming packets as a nonkey field for a Flexible NetFlow flow record:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect routing vrf input
The following example configures the forwarding status as a nonkey field for a Performance Monitor flow record:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect routing forwarding-status reason
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the use of the is-multicast field (indicating that the IPv4 traffic is multicast traffic) as a nonkey field, use the collect routing is-multicastcommand in flow record configuration mode. To disable the use of the is-multicast field as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords
The is-multicast field is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(22)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the is-multicast field as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect routing is-multicast
The following example configures the is-multicast field as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect routing is-multicast
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the multicast replication factor value for IPv4 traffic as a nonkey field for a flow record, use the collect routing multicast replication-factorcommand in flow record configuration mode. To disable the use of the multicast replication factor value as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The multicast replication factor value is not configured as a nonkey field.
Fow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(22)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
When the replication-factor field is used in a flow record, it will only have a non-zero value in the cache for ingress multicast traffic that is forwarded by the router. If the flow record is used with a flow monitor in output (egress) mode or to monitor unicast traffic or both, the cache data for the replication factor field is set to 0.
The following example configures the multicast replication factor value as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect routing multicast replication-factor
The following example configures the multicast replication factor value as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect routing multicast replication-factor
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one of the WAAS services fields as a nonkey field for a flow record, use the collect services wascommand in flow record configuration mode. To disable the use of this nonkey field for a flow record, use the no form of this command.
segment |
Configures the field for the WAAS services segment, as a nonkey field. |
passthrough-reason |
Configures the field for the WAAS services passthrough reason, as a nonkey field. |
WAAS services fields are not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release XE 3.8S |
This command was introduced. |
You must first enter the flow record type performance-monitorcommand before you can use this command. This command cannot be used with Flexible NetFlow.
Because the mode prompt is the same for Flexible NetFlow and Performance Monitor, the command mode for both products is referred to as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the use of the WAAS services passthrough-reason as a nonkey field for a performance monitor flow record:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect services waas passthrough-reason
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one of the absolute timestamp fields as a nonkey field for a flow record, use the collect timestamp absolute command in flow record configuration mode. To disable the use of one of the absolute timestamp fields as a nonkey field for a flow record, use the no form of this command.
first |
Configures the field for the first absolute timestamp, as a nonkey field. |
last |
Configures the field for the last absolute timestamp, as a nonkey field. |
The absolute timestamp fields are not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field for the first absolute timestamp, as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect absolute timestamp first
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the start time of the monitoring interval as a nonkey field for a flow record, use the collect timestamp interval command in flow record configuration mode. To disable the use of the start time of the monitoring interval as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The start time of the monitoring interval is not configured as a nonkey field.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the start time of the monitoring interval as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect timestamp interval
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the system uptime of the first seen or last seen packet in a flow as a nonkey field for a flow record, use the collect timestamp sys-uptime command in flow record configuration mode. To disable the use of the first seen or last seen packet in a flow as a nonkey field for a flow record, use the no form of this command.
first |
Configures the system uptime for the time the first packet was seen from the flows as a nonkey field and enables collecting time stamps based on the system uptime for the time the first packet was seen from the flows. |
last |
Configures the system uptime for the time the last packet was seen from the flows as a nonkey field and enables collecting time stamps based on the system uptime for the time the most recent packet was seen from the flows. |
The system uptime field is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
Support for this command was added for Cisco 7200 series routers in Cisco IOS Release 12.2(33)SRC. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
12.2(50)SY |
This command was integrated into Cisco IOS Release 12.2(50)SY. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures time stamps based on the system uptime for the time the first packet was seen from the flows as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect timestamp sys-uptime first
The following example configures the time stamps based on the system uptime for the time the most recent packet was seen from the flows as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect timestamp sys-uptime last
The following example configures the time stamps based on the system uptime for the time the most recent packet was seen from the flows as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect timestamp sys-uptime last
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the transport layer fields as a nonkey field for a flow record, use the collect transport command in flow record configuration mode. To disable the use of one or more of the transport layer fields as a nonkey field for a flow record, use the no form of this command.
destination-port |
Configures the destination port as a nonkey field and enables collecting the value of the destination port from the flows. |
igmp type |
Configures the Internet Group Management Protocol (IGMP) type as a nonkey field and enables collecting the value of the IGMP type from the flows. |
source-port |
Configures the source port as a nonkey field and enables collecting the value of the source port from the flows. |
The transport layer fields are not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
Support for this command was added for Cisco 7200 series routers in Cisco IOS Release 12.2(33)SRC. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the transport destination port as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport destination-port
The following example configures the transport source port as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport source-port
The following example configures the transport source port as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect transport source-port
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the event packet-loss counter field as a nonkey field for a flow record, use the collect transport event packet-loss countercommand in flow record configuration mode. To disable the use of the event packet-loss counter field as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The event packet-loss counter field is not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
The event packet-loss counter is incremented when a lost RTP packet is detected. However, the counter is also incremented when a reorder occurs, in other words, when packets are received out of order.
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures event packet-loss counter field as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect transport event packet-loss counter
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the internet control message protocol (ICMP) IPv4 type field and the code field as nonkey fields for a flow record, use the collect transport icmp ipv4 command in flow record configuration mode. To disable the use of the ICMP IPv4 type field and code field as nonkey fields for a flow record, use the no form of this command.
code |
Configures the ICMP code as a nonkey field and enables collecting the value of the ICMP code from the flow. |
type |
Configures the ICMP type as a nonkey field and enables collecting the value of the ICMP type from the flow. |
The ICMP IPv4 type field and the code field are not configured as nonkey fields.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
Support for this command was added for Cisco 7200 series routers in Cisco IOS Release 12.2(33)SRC. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the ICMP IPv4 code field as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport icmp ipv4 code
The following example configures the ICMP IPv4 type field as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport icmp ipv4 type
The following example configures the ICMP IPv4 type field as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect transport icmp ipv4 type
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure the Internet Control Message Protocol (ICMP) IPv6 type field and code field as nonkey fields for a flow record, use the collect transport icmp ipv6 command in flow record configuration mode. To disable the use of the ICMP IPv6 type field and code field as nonkey fields for a flow record, use the no form of this command.
code |
Configures the ICMP code as a nonkey field and enables collecting the value of the ICMP code from the flow. |
type |
Configures the ICMP type as a nonkey field and enables collecting the value of the ICMP type from the flow. |
The ICMP IPv6 type field and code field are not configured as nonkey fields.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(20)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the ICMP IPv6 code field as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport icmp ipv6 code
The following example configures the ICMP IPv6 type field as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport icmp ipv6 type
The following example configures the ICMP IPv6 type field as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect transport icmp ipv6 type
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the transport initiator port field as a nonkey field for a flow record, use the collect transport initiator port command in flow record configuration mode. To disable the use of one or more of the transport initiator port field as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The transport initiator port field is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the transport initiator port field as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect transport initiator port
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure various packet fields as a nonkey field for a flow record, use the collect transport packetscommand in flow record configuration mode. To disable the use of a packet field as a nonkey field for a flow record, use the no form of this command.
lost counter |
Configures the field that counts the number of lost packets as a nonkey field. |
lost rate |
Configures the field that counts the rate of lost packets as a nonkey field. |
expected counter |
Configures the field that counts the number of expected packets as a nonkey field. |
out-of-order |
Configures the number of out-of-order packets as a nonkey field and enables collecting the values from the flow. |
round-trip-time |
Configures the field for the packet round-trip-time as a nonkey field. |
The packet fields are not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
Cisco IOS XE Release 3.6S |
This command was modified. The out-of-order keyword was added into Cisco IOS XE Release 3.6S for Cisco Performance Monitor. |
You can retrieve different transport packet counters for RTP and TCP. The following transport packet counters as available:
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the field that counts the number of lost packets as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect transport packets lost counter
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure the transport responder port field as a nonkey field for a flow record, use the collect transport responder port command in flow record configuration mode. To disable the use of the transport responder port field as a nonkey field for a flow record, use the no form of this command.
This command has no arguments or keywords.
The transport responder port field is not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
Cisco IOS XE Release 3.8S |
This command was introduced. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the transport responder port field as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect transport responder port
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one of the RTP jitter fields as a nonkey field for a flow record, use the collect transport rtp jittercommand in flow record configuration mode. To disable the use of a jitter field as a nonkey field for a flow record, use the no form of this command.
jitter |
Configures the RTP jitter field as a nonkey field. |
mean |
Configures the mean value of the RTP jitter field as a nonkey field. |
maximum |
Configures the maximun value of the RTP jitter field as a nonkey field. |
minimum |
Configures the minumum value of the RTP jitter field as a nonkey field. |
The RTP jitter field is not configured as a nonkey field for a user-defined flow record.
flow record configuration (config-flow-record)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the RTP jitter field as a nonkey field:
Router(config)# flow record type performance-monitor PM-RECORD-4 Router(config-flow-record)# collect transport rtp jitter
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure one or more of the TCP fields as a nonkey field for a flow record, use the collect transport tcp command in flow record configuration mode. To disable the use of one or more of the TCP fields as a nonkey field for a flow record, use the no form of this command.
acknowledgement- number |
Configures the TCP acknowledgement number as a nonkey field and enables collecting the value of the TCP acknowledgment number from the flow. |
destination-port |
Configures the TCP destination port as a nonkey field and enables collecting the value of the TCP destination port from the flow. |
flags |
Configures one or more of the TCP flags as a nonkey field and enables collecting the values from the flow. |
ack |
(Optional) Configures the TCP acknowledgment flag as a nonkey field. |
cwr |
(Optional) Configures the TCP congestion window reduced flag as a nonkey field. |
ece |
(Optional) Configures the TCP Explicit Congestion Notification echo (ECE) flag as a nonkey field. |
fin |
(Optional) Configures the TCP finish flag as a nonkey field. |
psh |
(Optional) Configures the TCP push flag as a nonkey field. |
rst |
(Optional) Configures the TCP reset flag as a nonkey field. |
syn |
(Optional) Configures the TCP synchronize flag as a nonkey field. |
urg |
(Optional) Configures the TCP urgent flag as a nonkey field. |
header-length |
Configures the TCP header length (in 32-bit words) as a nonkey field and enables collecting the value of the TCP header length from the flow. |
maximum-segment-size |
Configures the maximum segment size as a nonkey field and enables collecting the values from the flow. |
sequence-number |
Configures the TCP sequence number as a nonkey field and enables collecting the value of the TCP sequence number from the flow. |
source-port |
Configures the TCP source port as a nonkey field and enables collecting the value of the TCP source port from the flow. |
urgent-pointer |
Configures the TCP urgent pointer as a nonkey field and enables collecting the value of the TCP urgent pointer from the flow. |
window-size |
Configures the TCP window size as a nonkey field and enables collecting the value of the TCP window size from the flow. |
window-size-average |
Configures the average window size as a nonkey field and enables collecting the values from the flow. |
window-size-maximum |
Configures the maximum window size as a nonkey field and enables collecting the values from the flow. |
window-size-minimum |
Configures the minimum window size as a nonkey field and enables collecting the values from the flow. |
The TCP fields are not configured as a nonkey field.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
Support for this command was added for Cisco 7200 series routers in Cisco IOS Release 12.2(33)SRC. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
12.2(50)SY |
This command was modified. The acknowledgement-number, destination-port, header-length, sequence-number,source-port, urgent-pointer,and window-sizekeywords were not supported in Cisco IOS Release 12.2(50)SY. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
Cisco IOS XE Release 3.6S |
This command was modified. The maximum-segment-size, window-size-average, window-size-maximum, and window-size-minimum keywords were added into Cisco IOS XE Release 3.6S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
collect transport tcp flags ece
For more information about ECN echo, refer to RFC 3168 The Addition of Explicit Congestion Notification (ECN) to IP , at the following URL: http://www.ietf.org/rfc/rfc3168.txt .
The following example configures the TCP acknowledgment number as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport tcp acknowledgement-number
The following example configures the TCP source port as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport tcp source-port
The following example configures the TCP acknowledgment flag as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport tcp flags ack
The following example configures the TCP finish flag as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport tcp flags fin
The following example configures the TCP reset flag as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport tcp flags rst
The following example configures the TCP reset flag as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect transport tcp flags rst
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To configure one or more of the user datagram protocol UDP fields as a nonkey field for a flow record, use the collect transport udp command in flow record configuration mode. To disable the use of one or more of the UDP fields as a nonkey field for a flow record, use the no form of this command.
destination-port |
Configures the UDP destination port as a nonkey field and enables collecting the value of the UDP destination port fields from the flow. |
message-length |
Configures the UDP message length as a nonkey field and enables collecting the value of the UDP message length fields from the flow. |
source-port |
Configures the UDP source port as a nonkey field and enables collecting the value of the UDP source port fields from the flow. |
The UDP fields are not configured as nonkey fields.
Flow record configuration (config-flow-record)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
Support for this command was added for Cisco 7200 series routers in Cisco IOS Release 12.2(33)SRC. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Cisco Performance Monitor. |
Cisco IOS XE Release 3.5S |
This command was integrated into Cisco IOS XE Release 3.5S for Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command, however the mode prompt is the same for both products. For Performance Monitor, you must first enter the flow record type performance-monitor command before you can use this command.
Because the mode prompt is the same for both products, here we refer to the command mode for both products as flow record configuration mode. However, for Flexible NetFlow, the mode is also known as Flexible NetFlow flow record configuration mode; and for Performance Monitor, the mode is also known as Performance Monitor flow record configuration mode.
The Flexible NetFlow collect commands are used to configure nonkey fields for the flow monitor record and to enable capturing the values in the fields for the flow created with the record. The values in nonkey fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a nonkey field does not create a new flow. In most cases the values for nonkey fields are taken from only the first packet in the flow.
The following example configures the UDP destination port as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport udp destination-port
The following example configures the UDP message length as a nonkey field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport udp message-length
The following example configures the UDP source port as a non-key field:
Router(config)# flow record FLOW-RECORD-1 Router(config-flow-record)# collect transport udp source-port
The following example configures the UDP source port as a nonkey field:
Router(config)# flow record type performance-monitor RECORD-1 Router(config-flow-record)# collect transport udp source-port
Command |
Description |
---|---|
flow record |
Creates a flow record, and enters Flexible NetFlow flow record configuration mode. |
flow record type performance-monitor |
Creates a flow record, and enters Performance Monitor flow record configuration mode. |
To enable the display of debugging information for the Performance Monitor component of Feature Manager, use the debug fm performance-monitorcommand in privileged EXEC mode. To disable debugging output, use the no form of this command.
all |
Displays information about adjacency messages on an ANCP server. |
dynamic |
Displays detailed static configuration information relating to ANCP and dynamic line conditions. |
event |
Displays information about ANCP protocol events. |
unusual |
Displays information about ANCP neighbors. |
verbose |
Displays information about ANCP control packets. |
vmr |
(Optional) Displays static configuration information for ANCP control packets. |
Privileged EXEC (#)
Release |
Modification |
---|---|
15.0(1)SY |
This command was introduced on the Catalyst 6500 platform. |
This command is available only on the Catalyst 6500 platform.
Debugging for the Performance Monitor component of Feature Manager is disabled.
The following example shows how to enable debugging for dynamic policy configuration.
Router# debug fm performance dynamic
Command |
Description |
---|---|
show platform hardware acl entry interface |
Displays information about inbound and outbound access control list (ACL) ternary content addressable memory (TCAM) interface entries. |
show platform software ccm |
Displays information about ternary content addressable memory (TCAM) Cisco CallManager (CCM) entries. |
show platform software feature-manager performance-monitor |
Displays information about the Performance Monitor component of Feature Manager. |
show platform software feature-manager tcam |
Displays information about dynamic ternary content addressable memory (TCAM) entries for the Performance Monitor component of Feature Manager. |
To enable debugging for performance monitor, use the debug performance monitorcommand in privileged EXEC mode. To disable debugging, use the no form of this command.
database |
Enables debugging for the flow database. |
dynamic |
Enables debugging for dynamic monitoring. |
event |
Enables debugging for performance events. |
export |
Enables debugging for exporting. |
flow-monitor |
Enables debugging for flow monitors. |
metering |
Enables debugging for the metering layer. |
provision |
Enables debugging for provisioning. |
sibling |
Enables debugging for sibling management. |
snmp |
Enables debugging for SNMP. |
tca |
Enables debugging for Threshold Crossing Alarms (TCA). |
timer |
Enables debugging for timers. |
Debugging for performance monitor is disabled.
Privileged EXEC
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
The following example shows how to enable debugging for dynamic monitoring:
Router# debug performance monitor dynamic
Command |
Description |
---|---|
flow exporter |
Creates a flow exporter. |
flow monitor type performance-monitor |
Creates a flow monitor. |
To configure a description for a flow exporter, flow record, flow monitor, or policy map use the descriptioncommand in the appropriate configuration mode. To remove the description, use the no form of this command.
description |
Text string that describes the flow exporter, flow record, flow monitor, or policy map. |
No description is configured.
Flow exporter configuration (config-flow-exporter)
Flow record configuration (config-flow-record)
Flow monitor configuration (config-flow-monitor)
Policy configuration (config-pmap)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
The description command is meant solely as a comment to be put in the configuration to help you remember information about the flow exporter, flow record, flow monitor, or policy map, such as which packets are included within the policy map.
The following example shows how to configuration a description for a flow record:
Router(config)# flow record type performance-monitor Router(config-flow-record)# description collect the number of IPV4 packet dropped Router(config-flow-record)# match ipv4 protocol Router(config-flow-record)# collect counter packets dropped
Command |
Description |
---|---|
flow exporter |
Creates a flow exporter. |
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
flow monitor type performance-monitor |
Creates a flow monitor. |
policy-map type performance-monitor |
Creates a policy map. |
To configure an export destination for a flow exporter, use the destination command in flow exporter configuration mode. To remove an export destination for a flow exporter, use the no form of this command.
ip-address |
IPv4 or IPv6 address of the workstation to which you want to send the NetFlow information. |
hostname |
Hostname of the device to which you want to send the NetFlow information. |
vrf vrf-name |
Specifies that the export data packets are to be sent to the named Virtual Private Network (VPN) routing and forwarding (VRF) instance for routing to the destination, instead of to the global routing table. |
An export destination is not configured.
flow exporter configuration (config-flow-exporter)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
This command was integrated into Cisco IOS Release 12.2(33)SRC and implemented on the Cisco 7200 series routers. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
Cisco IOS XE Release 3.1S |
This command was integrated into Cisco IOS XE Release 3.1S. |
15.1(3)T |
This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor. |
15.2(2)T |
This command was integrated into Cisco IOS Release 15.2(2)T for Flexible Netflow and Cisco Performance Monitor. |
This command can be used with both Flexible NetFlow and Performance Monitor.
Each flow exporter can have only one destination address or hostname. With Flexible Netflow, you can export to a either an IPv4 or IPv6 address.
When you configure a hostname instead of the IP address for the device, the hostname is resolved immediately and the IP address is stored in the running configuration. If the hostname-to-IP-address mapping that was used for the original domain name system (DNS) name resolution changes dynamically on the DNS server, the router does not detect this, and the exported data continues to be sent to the original IP address, resulting in a loss of data. Resolving the hostname immediately is a prerequisite of the export protocol, to ensure that the templates and options arrive before the data
The following example shows how to configure the networking device to export the Flexible NetFlow or Performance Monitorcache entry to a destination system using an IPv4 address:
Router(config)# flow exporter FLOW-EXPORTER-1 Router(config-flow-exporter)# destination 10.0.0.4
The following example shows how to configure the networking device to export the Flexible NetFlow cache entry to a destination system using an IPv6 address:
Router(config)# flow exporter FLOW-EXPORTER-1 Router(config-flow-exporter)# destination 10:0:0:4:4
The following example shows how to configure the networking device to export the Flexible NetFlow or Performance Monitor cache entry to a destination system using a VRF named VRF-1:
Router(config)# flow exporter FLOW-EXPORTER-1 Router(config-flow-exporter)# destination 172.16.10.2 vrf VRF-1
Command |
Description |
---|---|
flow exporter |
Creates a flow exporter. |
To configure a differentiated services code point (DSCP) value for flow exporter datagrams, use the dscp command in flow exporter configuration mode. To remove a DSCP value for flow exporter datagrams, use the no form of this command.
dscp |
The DSCP to be used in the DSCP field in exported datagrams. Range: 0 to 63. Default 0. |
The differentiated services code point (DSCP) value is 0.
flow exporter configuration (config-flow-exporter)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
This command was integrated into Cisco IOS Release 12.2(33)SRC and implemented on the Cisco 7200 series routers. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
15.1(3)T |
This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor. |
The following example sets 22as the value of the DSCP field in exported datagrams:
Router(config)# flow exporter FLOW-EXPORTER-1 Router(config-flow-exporter)# dscp 22
Command |
Description |
---|---|
flow exporter |
Creates a flow exporter. |
To configure the export protocol for a Flexible NetFlow exporter, use the export-protocol command in Flexible NetFlow flow exporter configuration mode. To restore the use of the default export protocol for a Flexible NetFlow exporter, use the no form of this command.
netflow-v5 |
Configures Netflow Version 5 export as the export protocol. |
netflow-v9 |
Configures Netflow Version 9 export as the export protocol. |
ipfix |
Configures IPFIX as the export protocol. The export of extracted fields from NBAR is supported only over IPFIX. |
Netflow Version 9 export is used as the export protocol for a Flexible NetFlow exporter.
Flexible NetFlow flow exporter configuration (config-flow-exporter)
Release |
Modification |
---|---|
12.4(22)T |
This command was introduced. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7200 and Cisco 7300 Network Processing Engine (NPE) series routers. |
Cisco IOS XE Release 3.1S |
This command was integrated into Cisco IOS XE Release 3.1S. |
15.1(3)T |
This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor. |
15.2(4)M |
This command was modified. The ipfix keyword was added in Cisco IOS Release 15.2(4)M. |
Cisco IOS XE Release 3.8S |
This command was integrated into Cisco IOS XE Release 3.8S. |
The NetFlow Version 5 export protocol is supported only for flow monitors that use the Flexible NetFlow predefined records.
The export of extracted fields from NBAR is supported only over IPFIX.
The following example configures Netflow Version 5 export as the export protocol for a Flexible NetFlow exporter:
Router(config)# flow exporter FLOW-EXPORTER-1 Router(config-flow-exporter)# export-protocol netflow-v5
Command |
Description |
---|---|
flow exporter |
Creates a flow exporter |
To configure a flow exporter for a flow monitor, use the exporter command in the appropriate configuration mode. To remove a flow exporter for a flow monitor, use the no form of this command.
exporter-name |
Name of a flow exporter that was previously configured. |
An exporter is not configured.
flow monitor configuration (config-flow-monitor)
Policy configuration (config-pmap-c)
Policy monitor configuration (config-pmap-c-flowmon)
Release |
Modification |
---|---|
12.4(9)T |
This command was introduced. |
12.2(31)SB2 |
This command was integrated into Cisco IOS Release 12.2(31)SB2. |
12.0(33)S |
This command was implemented on the Cisco 12000 series routers. |
12.2(33)SRC |
This command was integrated into Cisco IOS Release 12.2(33)SRC and implemented on the Cisco 7200 series routers. |
12.2(33)SRE |
This command was integrated into Cisco IOS Release 12.2(33)SRE for the Cisco 7300 Network Processing Engine (NPE) series routers. |
Cisco IOS XE Release 3.1S |
This command was integrated into Cisco IOS XE Release 3.1S. |
15.1(3)T |
This command was integrated into Cisco IOS Release 15.1(3)T for Cisco Performance Monitor. Support was added for policy configuration mode and policy monitor configuration configuration mode. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE for Cisco Performance Monitor. |
You must have already created a flow exporter by using the flow exporter command before you can apply the flow exporter to a flow monitor with the exporter command.
For Performance Monitor, you can associate a flow exporter with a flow monitor while configuring either a flow monitor, policy map, or service policy.
The following example configures an exporter for a flow monitor:
Router(config)# flow monitor FLOW-MONITOR-1 Router(config-flow-monitor)# exporter EXPORTER-1
The following example shows one of the ways to configure a flow exporter for Performance Monitor:
Router(config)# policy-map type performance-monitor policy-4 Router(config-pmap)# class class-4 Router(config-pmap-c)# flow monitor monitor-4 Router(config-pmap-c-flowmon)# exporter exporter-4
Command |
Description |
---|---|
flow exporter |
Creates a flow exporter. |
flow monitor |
Creates a flow monitor. |
flow monitor type performance-monitor |
Creates a flow monitor for Performance Monitor. |
policy-map type performance-monitor |
Creates a policy map for Performance Monitor |
service-policy type performance-monitor |
Associates policy map with an interface for Performance Monitor. |
To configure a flow monitor for Performance Monitor, use the flow monitor type performance-monitorcommand in global configuration mode. To remove flow monitor, use the no form of this command.
monitor-name |
Specifies which flow monitor is being configured. |
Global configuration (config)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
.Before you configure flow monitor, you should first configure a flow record and an optional flow exporter.
The following example shows how to configure a flow monitor:
Router(config)# flow monitor type performance-monitor PM-MONITOR-4
Command |
Description |
---|---|
flow record type performance-monitor |
Creates a flow record for Performance Monitor. |
To configure a flow record for Performance Monitor, use the flow record type performance-monitorcommand in global configuration mode. To remove the flow record, use the no form of this command.
record-name |
Specifies which flow record is being configured. |
Global configuration (config)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
A flow record requires at least one key field before it can be used in a flow monitor. The key fields differentiate flows, with each flow having a unique set of values for the key fields. The key fields are defined using the collect command.
The following example shows how to configure a flow record:
Router(config)# flow record type performance-monitor PM-RECORD-4
Command |
Description |
---|---|
flow monitor type performance-monitor |
Creates a flow monitor. |
To configure the maximum number of flows for each Performance Monitor cache, use the flowscommand in monitor parameters configuration mode. To remove the configuration, use the no form of this command.
number |
Specifies the number of flows to collect for the policy. |
Number of flows to collect is 8000.
Monitor parameters configuration (config-pmap-c-mparam)
Release |
Modification |
---|---|
15.1(3)T |
This command was introduced. |
12.2(58)SE |
This command was integrated into Cisco IOS Release 12.2(58)SE. |
The following example shows how to set the number of flows to collect for a Performance Monitor policy to four:
Router(config)# policy-map type performance-monitor PM-POLICY-4 Router(config-pamp)# class class-6 Router(config-pmap-c)# monitor parameters Router(config-pmap-c-mparam)# flows 4
Command |
Description |
---|---|
policy-map type performance-monitor |
Creates a policy for Performance Monitor. |
To configure the number of historical collections to keep for a Performance Monitor policy, use the historycommand in monitor parameters configuration mode. To remove the configuration, use the no form of this command.