Re: IP Acconting ....

sanjaynadarajah · ‎05-13-2008

Hi,

My question is with regards to the usage of the ip accouting command. The Cisco doc says that 'Only transit IP traffic is measured and only on an outbound basis ' ....

[1] When I do the below command, it looks like the 'rx' is high but if I do enable 'ip accounting' on the interface, would it display any output since rx is inbound traffic ?

-----------------------------------------

sh int s0/0/0:1

Serial0/0/0:1 is up, line protocol is up

Hardware is GT96K Serial

Description: 256k data circuit id DZEC939078

MTU 1500 bytes, BW 256 Kbit, DLY 20000 usec, reliability 255/255, txload 7/255, ** rxload 245/255 **

-----------------------------------------

[2] Also the interface s0/0/0:1 is the main interface and it has 2 sub point-to-point interfaces.

Therefore the ip accounting should be applied to one of the sub-interfaces right ? This is because when

I apply on the s0/0/0:1 interface, I do not see any display when I do a 'sh ip accounting' command ?

This is a 2800 router with IOS version 12.4(1a).

Pls advice,

Cheers,

- sn -

Preston Chilcote · ‎05-14-2008

I wouldn't expect it to show any output since the traffic is inbound. If you are trying to figure out what that traffic is, I suggest using netflow ("ip route-cache flow" on the interface). "show ip cache flow" will print out the flows on that interface. I don't know off the top of my head whether you need to configure on main or sub interface, but you can try it both ways. IP accounting is an old feature and netflow is the way to get this data going forward.

mahesh18 · ‎05-15-2008

Hi ,

i have amlost same case where ATM interface

has high RX traffic load.

we have enabled ip accounting on

this interface interface ATM0/0/0.777 point-to-point

interface ATM0/0/0.777 point-to-point

description -att-MPLS-E1-2M-1.6M-ePVC.777

bandwidth 1600

ip address 10.254.4.121 255.255.255.252

ip accounting output-packets

ip flow ingress

ip flow egress

no snmp trap link-status

when i do sh ip accoutning it shows

Source Destination Packets Bytes

10.15.226.233 10.12.29.21 59584 3168096

10.15.226.213 75.139.128.115 93295 4851340

10.15.227.48 10.12.29.206 870 83196

10.15.227.49 10.12.29.200 735 70506

10.15.226.21 10.24.64.165 19 1596

10.15.227.253 10.4.28.12 771 78677

10.15.227.238 10.50.17.36 7113 175223

so in this case i need to use netflow?

if yes how can i enable netflow on this router?

Preston Chilcote · ‎05-15-2008

If you're worried about RX, then the ip accounting won't help you. You actually already have netflow enabled on that interface ("ip flow ingress"). This is the alternative configuration to "ip route-cache flow" that I mentioned in the previous post.

So, since you already have netflow configured, just run "show ip cache flow" and look for flows on the ATM interface.

FYI

"ip flow ingress" will monitor just inbound traffic on that interface. "ip flow egress" will monitor outbound.

mahesh18 · ‎05-15-2008

hi than ks for reply

so enable netflow on any router inetrface

we can use the ip flow ingress command?

i ran the sh ip cache flow command it is lot

of output any way to understand the output?

any cisco article?

sh ip cache flow

IP packet size distribution (837497005 total packets):

1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480

.000 .521 .047 .037 .023 .018 .007 .006 .004 .005 .010 .002 .002 .002 .001

512 544 576 1024 1536 2048 2560 3072 3584 4096 4608

.001 .002 .002 .016 .284 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 278544 bytes

255 active, 3841 inactive, 67367017 added

1317107195 ager polls, 0 flow alloc failures

Active flows timeout in 30 minutes

Inactive flows timeout in 15 seconds

IP Sub Flow Cache, 21640 bytes

255 active, 769 inactive, 67367017 added, 67367017 added to flow

0 alloc failures, 360 force free

1 chunk, 134 chunks added

last clearing of statistics never

Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)

-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow

TCP-Telnet 616 0.0 11 47 0.0 5.2 9.1

TCP-FTP 706 0.0 5 66 0.0 3.8 10.5

TCP-FTPD 560 0.0 2 53 0.0 1.2 9.1

TCP-WWW 10550204 3.9 18 729 70.4 6.1 5.9

TCP-SMTP 2962 0.0 1 59 0.0 0.4 13.2

TCP-NNTP 431 0.0 2 44 0.0 1.5 7.7

TCP-Frag 527 0.0 2 659 0.0 2.5 15.5

TCP-other 46926523 17.3 12 417 223.6 7.0 12.5

UDP-DNS 1107752 0.4 1 70 0.6 2.5 15.4

UDP-NTP 132470 0.0 1 76 0.0 0.0 15.5

UDP-TFTP 378 0.0 5 52 0.0 7.9 15.5

UDP-Frag 852 0.0 2 469 0.0 3.2 15.4

UDP-other 6770550 2.5 3 193 9.1 4.7 15.4

ICMP 1867182 0.6 2 98 1.9 5.7 15.4

IP-other 5233 0.0 2031 472 3.9 316.3 13.8

Total: 67366946 24.9 12 479 309.9 6.5 11.9

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts

AT0/0/0.777 10.7.49.15 Fa0/0 10.15.226.4 06 1E78 A8B1 4

AT0/0/0.777 10.34.4.7 Fa0/0 10.15.226.4 06 1E78 8B09 2

AT0/0/0.777 74.125.45.99 Fa0/0 10.15.226.140 06 0050 04A3 5

AT0/0/0.777 10.25.40.16 Fa0/0 10.15.226.4 06 1E78 8A49 6

Fa0/0 10.15.226.4 AT0/0/0.777* 10.25.240.24 06 AAF8 1E78 34

AT0/0/0.777 10.24.62.55 Fa0/0 10.15.226.4 06 B8AF 1E78 2

Fa0/0 10.15.226.4 AT0/0/0.777* 10.24.62.55 06 1E78 B8AF 2

Fa0/0 10.15.226.4 AT0/0/0.777* 10.3.61.7 06 1E78 5E62 2

AT0/0/0.777 10.54.63.17 Fa0/0 10.15.226.4 06 BADF 1E78 2

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts

Fa0/0 10.15.226.4 AT0/0/0.777* 10.50.33.10 06 EBB5 1E78 8407

Fa0/0 10.15.226.108 AT0/0/0.777* 10.253.108.7 11 00A1 0403 1

Fa0/0 10.15.226.4 AT0/0/0.777* 10.25.40.16 06 D341 1E78 2

AT0/0/0.777 10.24.62.55 Fa0/0 10.15.226.4 06 1E78 692D 2

AT0/0/0.777 10.32.62.10 Fa0/0 10.15.226.4 06 1E78 8D01 96

AT0/0/0.777 74.53.127.242 Fa0/0 10.15.226.140 06 0050 04BA 4

Fa0/0 10.15.226.4 AT0/0/0.777* 10.24.62.55 06 692D 1E78 2

AT0/0/0.777 10.5.158.7 Fa0/0