IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Per-interface statistics

Updated: August 12, 2026

Want to summarize with AI?

Log in

This topic describes per-interface ACL entry (ACE) drop counters, which you enable by using the interface-statistics keyword when you bind an ACL to an interface.

When you bind an ACL to interfaces, you can configure ACE drop counts by using the interface-statistics keyword in per-interface mode.

You can allocate up to 8 stats counters per NPU. This also limits the number of interfaces that can support the same ACL in per-interface-stats mode to 8. Additional binding of the same ACL in per-interface-stats mode is rejected.

Note

For a specific direction, all interfaces on a line card using the same ACL must be configured in the same stats mode; otherwise, the subsequent binding is rejected.

This behavior applies to bundle interfaces too. If you add any member to the existing bundle interface with a different stats mode, the binding is rejected.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

Per Interface Statistics

Release 26.2.1

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]):*

*This feature is supported on:

  • 88-LC1-48Y8H-EM

Per Interface Statistics

Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8011-4G24Y4H-I

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

Configure per-interface statistics

Use this procedure to bind an ACL to an interface with the interface-statistics keyword and verify the per-interface deny statistics.

Procedure

  1. Bind the ACL to the interface with the interface-statistics keyword.

    Example:

    Router(config)# interface HundredGigE 0/0/0/0
Router(config-if)# ipv4 address 1.1.1.1 255.255.0.0
Router(config-if)# ipv6 address 2001::1/64
Router(config-if)# ipv4 access-group test ingress interface-statistics
Router(config-if)# commit

  2. Verify the per-interface deny statistics by using the show access-lists ipv4 acl-name hardware ingress interface interface location node-id command.

    Example:

    Router# show access-lists ipv4 test hardware ingress interface FourHundredGigE 0/1/0/0 location 0/1/CPU0
ipv6 access-list test
10 permit ipv6 any 200:23::/64
20 deny udp any any (2356 matches)

    You have successfully enabled per-interface ACE drop counters and verified the deny statistics on the interface.