Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Verify DDoS edge protection

Updated: September 8, 2026

Want to summarize with AI?

Log in

Verify that the DDoS edge protection controller has successfully applied all configurations to the router by checking the AppMgr configuration, flow monitor cache, flow exporter status, and Docker application state.

Use this procedure to confirm that the DDoS controller has applied the required configuration to the router and that the detector container is running correctly.

Procedure

  1. Run the show running-config appmgr command to verify the AppMgr configuration.

    Example:

    RP/0/RP0/CPU0:Router# show running-config appmgr
Thu Jun  1 07:33:36.741 UTC
appmgr
 application esentryd
  activate type docker source esentryd-cisco-20230431633 docker-run-opts "--env-file /harddisk:/ENV_6478443711ac6830700d1aeb --net=host"
 !
!

    The output confirms that the esentryd application is activated as a Docker container with the correct source and run options. The --net=host option is required for the container to communicate with the DDoS controller.

  2. Run the show flow monitor to confirm that the monitor maps are active and exporting flows.

    Example:

    Router# show flow monitor DetectPro_Monitor_IPV4 cache location 0/0/CPU0
Cache summary for Flow Monitor DetectPro_Monitor_IPV4:
Cache size:                        1000000
Current entries:                         0
Flows added:                    2243884200
Flows not added:                         0
Ager Polls:                     2243884200
  - Active timeout                       0
  - Inactive timeout                     0
  - Total                       2243884200
Flows exported                  2243884200
Matching entries:                        0
!

Router# show flow monitor DetectPro_Monitor_IPV6 cache location 0/0/CPU0
Cache summary for Flow Monitor DetectPro_Monitor_IPV6:
Cache size:                        1000000
Current entries:                         0
Flows added:                         59971
Flows not added:                         0
Ager Polls:                          94437
  - Active timeout                   59971
  - Total                            59971
Flows exported                       59971
Matching entries:                        0

Router# show flow monitor mon_mpls_ipv4_ipv6 cache format record location 0/RP0/CPU0
Cache summary for Flow Monitor mon_mpls_ipv4_ipv6:
Cache size:                        1000000
Current entries:                         0
Flows added:                           963
Flows exported                         963
!

    The output shows that flows are being added and exported for both DetectPro_Monitor_IPV4 and DetectPro_Monitor_IPV6 monitor maps. From Release 25.2.1, verify the mon_mpls_ipv4_ipv6 monitor map as well. Non-zero Flows exported values confirm that the monitor maps are actively exporting traffic data to the detector container.

  3. Run the show flow exporter command to confirm that traffic data is being exported to the detector container destination.

    Example:

    RP/0/RP0/CPU0:Router# show flow exporter DetectPro_GPB location 0/0/CPU0
Thu Nov 16 06:13:58.059 UTC
Flow Exporter: DetectPro_GPB
Export Protocol: protobuf
Flow Exporter memory usage: 5265344
Used by flow monitors: DetectPro_Monitor_IPV4
                       DetectPro_Monitor_IPV6
Status: Disabled
Transport:   UDP
Destination: 15.1.1.2        (5005) VRF default
Source:      0.0.0.0         (54482)
Flows exported:                                   0 (0 bytes)
Packets exported:                          20355756 (27716506821 bytes)
Packets dropped:                                  0 (0 bytes)

    From Release 25.2.1, also verify the MPLS exporter:

    Router# show flow exporter exp_mpls_ipv4_ipv6 location 0/RP0/CPU0
Flow Exporter: exp_mpls_ipv4_ipv6
Export Protocol: protobuf
Used by flow monitors: mon_mpls_ipv4_ipv6
Status: Normal
Transport:   UDP
Destination: 15.1.1.2        (5005) VRF default
Source:      17.1.1.1        (54341)
Flows exported:                                  963 (159519 bytes)
Packets exported:                               122 (159519 bytes)
Packets dropped:                                  0 (0 bytes)

    The output confirms the exporter destination IP (15.1.1.2), UDP port (5005), and protocol (protobuf). A non-zero Packets exported value confirms that traffic is being sent to the detector container. Zero Packets dropped confirms no export failures.

  4. Run the show appmgr application-table command to confirm the Docker application is running.

    Example:

    RP/0/RP0/CPU0:Router# show appmgr application-table
Thu Nov 16 06:13:58.059 UTC
Name     Type   Config State Status
-------- ------ ------------ --------------------------------------------------
esentryd Docker  Activated   Up 8 minutes
RP/0/RP0/CPU0:Router#

    The output confirms that the esentryd Docker application is in the Activated config state and the status shows Up, indicating that the detector container is running successfully.

All verification checks confirm that the DDoS edge protection controller has applied the required configuration to the router, the detector container is running and active, and flow records are being exported correctly for DDoS traffic analysis.