netflow question(Pkts count is 0)

Unanswered Question
Mar 16th, 2010
User Badges:

hi all,


i enable mls netflow and ip route-cache flow in c7613, sup720-3bxl.


conf t

mls netflow

int gi7/2

ip route-cache flow


above configuration, i enabled mls netflow in global mode and applied "ip route-cache flow" for supervsor720 giga-ehternet interface.


but i can understand why Pkts counter is 0 in the output of "show ip cache flow"


=========================================================================

SG1#sh ip cache flow

-------------------------------------------------------------------------------
MSFC:
IP packet size distribution (378649 total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .000 .152 .344 .066 .033 .012 .073 .078 .010 .009 .010 .004 .123 .051 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .002 .006 .014 .007 .000 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 4456704 bytes
  9 active, 65527 inactive, 31491 added
  688308 ager polls, 0 flow alloc failures
  Active flows timeout in 30 minutes
  Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 270664 bytes
  9 active, 16375 inactive, 31491 added, 31491 added to flow
  0 alloc failures, 0 force free
  1 chunk, 0 chunks added
  last clearing of statistics 1d02h
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
TCP-Telnet        6953      0.0         4    41      0.3       0.2       2.7
TCP-FTP             35      0.0        14    64      0.0       0.4      15.5
TCP-other        23823      0.2         1    47      0.2       0.0      15.5
UDP-other          627      0.0       470   217      3.0     282.0      13.5
ICMP                52      0.0       420    84      0.2    1799.0       1.5
Total:           31490      0.3        11   183      3.9       8.6      12.6

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Gi7/2         172.31.247.238  Local         10.2.1.1        01 0000 0800   341
Gi7/2         172.31.247.238  Local         10.2.1.1        06 C8FD 0017     3
Gi7/2         172.31.247.238  Local         1.1.1.1         06 DEAD 0017    18
Gi7/2         172.31.247.238  Local         10.2.1.1        06 E032 1011     1
Gi7/2         172.31.247.238  Local         10.2.1.1        06 E030 1011     1
Gi7/2         172.31.247.238  Local         10.2.1.1        06 E02E 1011     1
Gi7/2         172.31.247.238  Local         10.2.1.1        06 E02C 1011     1
Gi7/2         172.31.247.238  Local         10.2.1.1        11 A123 00A1  2697
Gi7/2         172.31.247.238  Local         10.2.1.1        11 A124 00A1  1380

-------------------------------------------------------------------------------
PFC:
         
Displaying Hardware entries in Module 7
SrcIf            SrcIPaddress          DstIPaddress      Pr       SrcP      DstP      Pkts
Fa10/0/0         10.1.9.1              10.4.9.41         132      4013      4013      2851        
Fa3/0/0          10.1.3.1              10.4.20.11        132      4019      4019      0           
Fa10/0/0         10.1.9.1              10.7.9.21         132      7011      7011      3387        
Fa3/0/1          10.1.4.1              10.4.10.11        132      4009      4009      2579        
Fa3/0/0          10.1.3.1              10.4.9.11         132      4009      4009      2579        
Fa10/0/1         10.1.10.1             10.4.10.41        132      4014      4014      2850        
Fa10/0/1         10.1.10.1             10.7.10.21        132      7011      7011      3107        
Fa5/0/0          10.1.5.1              10.4.9.12         132      4010      4010      2581        
Fa10/0/0         10.1.9.1              10.4.9.21         132      4011      4011      2644        
Fa3/0/1          10.1.4.1              10.7.16.21        132      7019      7019      7           
Fa10/0/1         10.1.10.1             10.4.10.21        132      4011      4011      2656        
Fa10/0/0         10.1.9.1              10.8.1.11         132      8000      8000      21          
Fa3/0/1          10.1.4.1              10.7.15.11        132      7015      7015      7           
Fa10/0/1         10.1.10.1             10.7.2.11         132      7001      7001      20          
Fa5/0/1          10.1.6.1              10.4.10.12        132      4010      4010      2581        
Fa10/0/1         10.1.10.1             10.8.2.11         132      8000      8000      15          
Fa3/0/0          10.1.3.1              10.7.16.11        132      7015      7015      7           
Gi7/2            172.31.247.238        10.2.1.1          tcp      57386     4113      0           
Fa3/0/1          10.1.4.1              10.7.15.21        132      7019      7019      7           
Fa10/0/0         10.4.1.11             10.1.9.1          icmp     8         0         0           
Fa3/0/0          10.1.3.1              10.7.16.21        132      7019      7019      7         



above output consists two parts : MSFC and PFC

if i just enable ip route-cache flow for gi7/2(not enable mls netflow in global mode)

then PFC part is not shown. it shows just MSFC part


config t

no mls netflow

int gi7/2

ip route-cache flow

end


show ip cache flow

-------------------------------------------------------------------------------
MSFC:
IP packet size distribution (384674 total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .000 .152 .343 .066 .033 .012 .073 .078 .010 .009 .010 .004 .123 .051 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .002 .006 .014 .007 .000 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 4456704 bytes
  8 active, 65528 inactive, 31973 added
  699019 ager polls, 0 flow alloc failures
  Active flows timeout in 30 minutes
  Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 270664 bytes
  8 active, 16376 inactive, 31973 added, 31973 added to flow
  0 alloc failures, 0 force free
  1 chunk, 0 chunks added
  last clearing of statistics 1d02h
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
TCP-Telnet        7063      0.0         4    41      0.3       0.2       2.7
TCP-FTP             35      0.0        14    64      0.0       0.4      15.5
TCP-other        24189      0.2         1    47      0.2       0.0      15.5
UDP-other          633      0.0       474   218      3.1     285.0      13.5
ICMP                53      0.0       420    84      0.2    1799.0       1.5
Total:           31973      0.3        11   183      3.9       8.6      12.6

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Gi7/2         172.31.247.238  Local         10.2.1.1        01 0000 0800   261
Gi7/2         172.31.247.238  Local         1.1.1.1         06 DEAD 0017   189
Gi7/2         172.31.247.238  Local         10.2.1.1        06 E37A 1011     1
Gi7/2         172.31.247.238  Local         10.2.1.1        06 E378 1011     1
Gi7/2         172.31.247.238  Local         10.2.1.1        06 E37E 1011     1
Gi7/2         172.31.247.238  Local         10.2.1.1        06 E37C 1011     1
Gi7/2         172.31.247.238  Local         10.2.1.1        11 A123 00A1  2190
Gi7/2         172.31.247.238  Local         10.2.1.1        11 A124 00A1  1035

-------------------------------------------------------------------------------
PFC:

Displaying Hardware entries in Module 7
SrcIf            SrcIPaddress          DstIPaddress      Pr       SrcP      DstP      Pkts


Displaying Hardware entries in Module 8
SrcIf            SrcIPaddress          DstIPaddress      Pr       SrcP      DstP      Pkts


above output say that "ip route-cache flow" shows the cache entry in MSFC.




in opposite,

if i just enable mls netflow(not enable ip route-cache flow for gi7/2)

then MSFC part is not shown. it shows just PFC part


conf t

int gi7/2

no ip route-cache flow

exit

mls netflow

end


SG1#sh ip cache flow

-------------------------------------------------------------------------------
MSFC:
IP packet size distribution (0 total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 0 bytes
  0 active, 0 inactive, 0 added
  0 ager polls, 0 flow alloc failures
  Active flows timeout in 30 minutes
  Inactive flows timeout in 15 seconds
  last clearing of statistics 00:00:11
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts

-------------------------------------------------------------------------------
PFC:

Displaying Hardware entries in Module 7
SrcIf            SrcIPaddress          DstIPaddress      Pr       SrcP      DstP      Pkts
Fa10/0/0         10.1.9.1              10.4.9.41         132      4013      4013      20          
Fa3/0/1          10.1.4.1              10.4.10.11        132      4009      4009      16          
Fa3/0/0          10.1.3.1              10.4.9.11         132      4009      4009      16          
Fa10/0/1         10.1.10.1             10.8.2.11         132      8000      8000      3           
Fa10/0/1         10.1.10.1             10.7.10.21        132      7011      7011      15          
Fa10/0/1         10.1.10.1             10.4.10.41        132      4014      4014      19          
Fa10/0/0         10.1.9.1              10.7.9.21         132      7011      7011      15          
Fa5/0/0          10.1.5.1              10.4.9.12         132      4010      4010      15          
Fa10/0/0         10.1.9.1              10.4.9.21         132      4011      4011      15          
Fa3/0/1          10.1.4.1              10.7.16.21        132      7019      7019      2           
Fa10/0/1         10.1.10.1             10.4.10.21        132      4011      4011      15           
Fa10/0/1         10.1.10.1             10.4.2.11         132      4001      4001      2           
Fa5/1/1          10.1.8.1              100.1.8.13        132      2000      2000      1           
Gi7/2            172.31.247.238        10.2.1.1          tcp      58729     4113      0           
Fa3/0/0          10.1.3.1              10.7.15.21        132      7019      7019      5           
Gi7/2            172.31.247.238        10.2.1.1          icmp     8         0         0           
Fa10/0/0         10.7.1.11             10.1.9.1          icmp     8         0         0
           
Fa10/1/1         10.1.12.1             10.7.52.11        132      17001     17001     1           
Fa10/0/0         10.1.9.1              10.8.1.11         132      8000      8000      2           
Fa3/0/1          10.1.4.1              10.4.9.31         132      4007      4007      1           
Fa10/1/1         10.7.52.11            10.1.12.1         icmp     4         0         0           
Fa10/1/0         10.1.11.1             10.7.51.11        132      17001     17001     4           
Fa10/0/1         10.7.2.11             10.1.10.1         icmp     8         0         0    


   

above output,

i can understand why Pkts count is 0.

i think Pkts count = 0 means no packet

but why 0 count is shown?


the packets are cpu punted packets?

so counter is 0?


if i'm right, the entries(that has count=0) are punted RP cpu.

am i right?


is there anyone about this?



relative url :

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps6601/prod_white_paper0900aecd80406232.html

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Giuseppe Larosa Wed, 03/17/2010 - 06:14
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Sanghee,

when you enable MLS netflow traffic is processed by PFC so counters for MSFC are 0


you shouldn't look at MSFC statistics at this point.



http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/netflow.html#wp1134373


it says :


>>

The NetFlow feature on the RP captures statistics for flows routed in  software.

For additional information about configuring NetFlow on the RP, see the Cisco  IOS NetFlow Configuration Guide, Release 12.2SX.


Hope to help

Giuseppe


Actions

This Discussion