MACsec Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Release

PDF

MACsec Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Release

MACsec SecY statistics

Updated: September 11, 2026

Want to summarize with AI?

Log in

Provides comprehensive guidance on monitoring and troubleshooting MACsec performance using SecY statistics, SNMP MIBs, and CLI commands to ensure secure network management and diagnostics.

This chapter provides comprehensive guidance on monitoring and troubleshooting MACsec performance using SecY statistics, SNMP MIBs, and CLI commands. Users can learn how to access detailed encryption and decryption metrics, retrieve MACsec interface indexes, and perform SNMP queries for secure network management and diagnostics.

Query SNMP statistics

Administrators can query SNMP statistics through the CLI to view detailed information about MACsec SecY statistics on a specific interface.

Use the show macsec secy statistics interface command to display detailed MACsec SecY statistics for a specified interface.

  • Example:

    Router# show macsec secy stats interface hundredGigE 0/1/0/10 sc

Interface Stats
    InPktsUntagged     :  0
    InPktsNoTag        :  0
    InPktsBadTag       :  0
    InPktsUnknownSCI   :  0
    InPktsNoSCI        :  0
    InPktsOverrun      :  0
    InOctetsValidated  :  0
    InOctetsDecrypted  :  0
    OutPktsUntagged    :  0
    OutPktsTooLong     :  0
    OutOctetsProtected :  0
    OutOctetsEncrypted :  0

SC Stats
  TxSC Stats
    OutPktsProtected   : 0
    OutPktsEncrypted   : 0
    OutOctetsProtected : 0
    OutOctetsEncrypted : 0
    OutPktsTooLong     : 0
    TxSA Stats
      TxSA 0: 
        OutPktsProtected : 0
        OutPktsEncrypted : 0
        NextPN           : 1
      TxSA 1: 
        OutPktsProtected : 0
        OutPktsEncrypted : 0
        NextPN           : 0
      TxSA 2: 
        OutPktsProtected : 0
        OutPktsEncrypted : 0
        NextPN           : 0
      TxSA 3: 
        OutPktsProtected : 0
        OutPktsEncrypted : 0
        NextPN           : 0

  RxSC Stats
    RxSC 1: 10000742d968a00
      InPktsUnchecked     : 0
      InPktsDelayed       : 0
      InPktsLate          : 0
      InPktsOK            : 0
      InPktsInvalid       : 0
      InPktsNotValid      : 0
      InPktsNotUsingSA    : 0
      InPktsUnusedSA      : 0
      InPktsUntaggedHit   : 0
      InOctetsValidated   : 0
      InOctetsDecrypted   : 0
    RxSA Stats
      RxSA 0: 
        InPktsUnusedSA      : 0
        InPktsNotUsingSA    : 0
        InPktsNotValid      : 0
        InPktsInvalid       : 0
        InPktsOK            : 0
        NextPN              : 1
      RxSA 1: 
        InPktsUnusedSA      : 0
        InPktsNotUsingSA    : 0
        InPktsNotValid      : 0
        InPktsInvalid       : 0
        InPktsOK            : 0
        NextPN              : 0
      RxSA 2: 
        InPktsUnusedSA      : 0
        InPktsNotUsingSA    : 0
        InPktsNotValid      : 0
        InPktsInvalid       : 0
        InPktsOK            : 0
        NextPN              : 0
      RxSA 3: 
        InPktsUnusedSA      : 0
        InPktsNotUsingSA    : 0
        InPktsNotValid      : 0
        InPktsInvalid       : 0
        InPktsOK            : 0
        NextPN              : 0

  • On Cisco 8712-MOD-M routers, all TxSC (Transmit Secure Channel) counters display a value of zero. This behavior occurs due to a hardware limitation — K100 ASIC-based systems used in these routers do not support the collection of TxSC statistics.

MACsec SecY egress counters

  • Starting with Cisco IOS XR Release 26.3.1, the show macsec secy stats interface interface-name sc command can display zero for the MACsec egress counters, including OutOctetsProtected , OutOctetsEncrypted , and the TxSC and TxSA egress counters on systems based on A100 and K100 ASICs.

    Note

    • On A0-revision boards, the OutOctetsProtected and OutOctetsEncrypted counters report zero at both the SC and SA levels. This does not affect traffic protection or encryption. C0-revision boards do not exhibit this behavior.

    • The zero values do not indicate a traffic or MACsec encryption failure. To verify egress encryption on an affected system, use the show macsec platform stats interface interface-name command and check the encrypted packet and octet counters.

  • The show macsec secy stats interface interface-name sc command can display these zero values on an affected system:

    Router# show macsec secy stats interface hundredGigE 0/1/0/10 sc
Interface Stats
    OutOctetsProtected : 0
    OutOctetsEncrypted : 0

SC Stats
  TxSC Stats
    OutPktsProtected   : 0
    OutPktsEncrypted   : 0
    OutOctetsProtected : 0
    OutOctetsEncrypted : 0
  TxSA Stats
    TxSA 0:
      OutPktsProtected : 0
      OutPktsEncrypted : 0

MACsec OutPktsUntagged counter behavior

  • When MACsec is enabled, the OutPktsUntagged counter increments because it includes periodic keep-alive MACsec control packets transmitted at regular intervals.

  • The show macsec secy stats interface interface-name command displays the OutPktsUntagged counter.

    Note
    This counter behavior is consistent across A100 and K100 based PIDs, excluding A0 revisions.