Displaying and Clearing IP Access List Data Using ACL Manageability
|
|||||||||||||
Contents
Displaying and Clearing IP Access List Data Using ACL ManageabilityLast Updated: May 14, 2011
This module describes how to display the entries in an IP access list and the number of packets that have matched each entry. Users can get these statistics globally, or per interface and per incoming or outgoing traffic direction, by using the ACL Manageability feature. Viewing details of incoming and outgoing traffic patterns on various interfaces of a network device can help secure devices against attacks coming in on a particular interface. This module also describes how to clear counters so that the count of packets matching an access list entry will restart from zero.
Finding Feature InformationYour software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required. Information About Displaying and Clearing IP Access List Data Using ACL ManageabilityBenefits of ACL ManageabilityPrior to Cisco IOS Release 12.4(6)T, the ACL infrastructure in Cisco IOS software maintained only global statistics for each ACE in an ACL. With this method, if an ACL is applied to multiple interfaces, the maintained ACE statistics are the sum of incoming and outgoing packet matches (hits) on all the interfaces on which that ACL is applied. However, if ACE statistics are maintained per interface and per incoming or outgoing traffic direction, users can view specific details of incoming and outgoing traffic patterns and the effectiveness of ACEs on the various interfaces of a network device. This type of information is useful for securing devices against attacks coming in on a particular interface. Support for Interface-Level ACL StatisticsWith Cisco IOS Release 12.4(6)T, the ACL infrastructure in Cisco IOS software is now extended to support the maintenance, display, and clearing of ACE statistics per interface and per incoming or outgoing traffic direction for ACLs. This support is often referred to as âsupport for interface-level statistics.â How to Display and Clear IP Access List DataThis section contains the following procedures for displaying IP access lists and the counts of packets that match (hit) each list, and for clearing IP access list counters.
Displaying Global IP ACL StatisticsPerform this task to display all IP access lists on the router and counts of packets that have matched. DETAILED STEPS Displaying Interface-Level IP ACL StatisticsThis section describes how to display IP ACE statistics per interface and per incoming or outgoing traffic direction for ACLs. This feature is known as ACL Manageability. DETAILED STEPS Clearing the Access List CountersThe system counts how many packets match (hit) each line of an access list; the counters are displayed by the show access-lists EXEC command. Perform this task to clear the counters of an access list. You might do this if you are trying to determine a more recent count of packets that match an access list, starting from zero. DETAILED STEPS Configuration Examples for Displaying and Clearing IP Access List Data Using ACL Manageability
Example Displaying Input StatisticsThe following example displays statistics on incoming packets gathered from the FastEthernet interface 0/1, associated with access list 150 (ACL number):
Router#
show ip access-list interface FastEthernet 0/1 in
Extended IP access list 150 in
10 permit ip host 10.1.1.1 any (3 matches)
30 permit ip host 10.2.2.2 any (12 matches)
Example Displaying Input and Output Statistics
The following example displays input and output statistics gathered from the FastEthernet interface 0/0:
Router#
show ip access-list interface FastEthernet 0/0
Extended IP access list 150 in
10 permit ip host 10.1.1.1 any
30 permit ip host 10.2.2.2 any (15 matches)
Extended IP access list myacl out
5 deny ip any 10.1.0.0 0.0.255.255
10 permit udp any any eq snmp (6 matches)
Additional ReferencesRelated DocumentsMIBsTechnical Assistance
Feature Information for Displaying IP Access List Information and Clearing CountersThe following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R) Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. |
|||||||||||||