Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

CSS "flow display <flow identifier>" - timestamp

Hi,

does anyone know, how to interprete the timestamp of

"Time last frame was seen = <time>"

in "flow display <flows identifier>.

This value seems to be an absolut timestamp, but I don´t know how could I find out the real time.

In the example the value is "42629":

Time last frame was seen = 42629

What what does this value means.

complete output:

css01-23(debug)# flow active-list

-------- -------------- ----- -------------- ----- -- -------- -------- --------

Flow ID Src IP SPort Dst IP DPort Pr IgrsPort EgrsPort Flow flg

-------- -------------- ----- -------------- ----- -- -------- -------- --------

04010064 172.29.148.171 389 172.29.27.133 52440 6 01203240 00201940 822a2a00

04010923 172.29.148.171 389 172.29.27.133 56537 6 01203240 00201940 822a2a00

css01-23(debug)# show clock

Date: 03-19-2004

Time: 10:20:17

TimeZone: mez: +01:+00:+00

css01-23(debug)#

css01-23(debug)# flow display 0x04010064

Flow found on SP on Slot 2, Subslot 1

Detailed information for FlowId: 0x04010064, FpId: 0x844A5A40:

Ingress port = 0x01203240 Egress port = 0x00201940

State of this flow ( flow flags ) = 0x822a2a00 0x00

Partner flow id = 0x400ff8e

FCB flags = 0x00000419

Route Id = 0x8a63ac90

Host Id = 0x8a6d1480

Total number of SYNs received for this flow = 0

WCC cookie stat for this flow = 0

Protocol is TCP

IP: Source = 172.29.148.171-389 Dest = 172.29.27.133-52440

NAT IP: Source = 172.29.149.147-389 Dest = 172.29.27.133-52440

NAT tcp seq num delta used in L5 spoofing = 0x00000000

Time last frame was seen = 42629

Flow statistics bytesIn = 0 framesIn = 0

Src macaddr = 00-0b-fd-be-c6-7d Dest macaddr = 00-01-f4-16-e5-e6

Out of sequence discards = 0

Session Redundancy State: Active

Previous Flow ID: 0x0

Local Flow ID: 0x4010064

css01-23(debug)# show clock

Date: 03-19-2004

Time: 10:24:54

TimeZone: mez: +01:+00:+00

css01-23(debug)# flow display 0x04010064

Flow found on SP on Slot 2, Subslot 1

Detailed information for FlowId: 0x04010064, FpId: 0x844A5A40:

Ingress port = 0x01203240 Egress port = 0x00201940

State of this flow ( flow flags ) = 0x822a2a00 0x00

Partner flow id = 0x400ff8e

FCB flags = 0x00000419

Route Id = 0x8a63ac90

Host Id = 0x8a6d1480

Total number of SYNs received for this flow = 0

WCC cookie stat for this flow = 0

Protocol is TCP

IP: Source = 172.29.148.171-389 Dest = 172.29.27.133-52440

NAT IP: Source = 172.29.149.147-389 Dest = 172.29.27.133-52440

NAT tcp seq num delta used in L5 spoofing = 0x00000000

Time last frame was seen = 42629

Flow statistics bytesIn = 0 framesIn = 0

Src macaddr = 00-0b-fd-be-c6-7d Dest macaddr = 00-01-f4-16-e5-e6

Out of sequence discards = 0

Session Redundancy State: Active

Previous Flow ID: 0x0

Local Flow ID: 0x4010064

regards

sascha

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: CSS "flow display <flow identifier>" - timestamp

ok.

From the code.

CurSecs: 315164:145 means 315164sec and 145 msec.

Last activity means the time when a packet was seen last time in sec.

The time is a value in seconds since boot.

So you should do CurSecs - last activity to have the

idle time.

Gilles.

4 REPLIES
Cisco Employee

Re: CSS "flow display <flow identifier>" - timestamp

Sascha is this a 1st gen or 2nd gen CSS ?

If 2nd gen, you should actually use a different command.

'flow-agent show active_fcbs'

then

'flow-agent show fcb_details 0x'

With the 2nf gen, you can poll the flow-agent that is responsible to do the fastswitching.

It will give you better info then the old command which gives only information seen at software level.

Regards,

Gilles.

New Member

Re: CSS "flow display <flow identifier>" - timestamp

Hi Gilles,

thanks for feedback, the cmd works:

css01-23(debug)# flow-agent show active_fcbs

-------- -------------- ----- -------------- ----- -- -------- ------- --------

Flow ID Src IP SPort Dst IP DPort Pr slot sub spt dpt Flow flg

-------- -------------- ----- -------------- ----- -- -------- ------- --------

83d4cb60 172.29.148.168 81 172.19.28.165 2015 6 2 1 1 1 00000099

83e31160 172.29.148.168 81 172.26.54.87 1963 6 2 1 1 1 00000099

83a2f3a0 172.29.148.171 389 172.29.148.170 16034 6 2 1 1 1 00000119

--Cancelled---

css01-23(debug)# flow-agent show fcb_details 0x8394a140

css01-23(debug)#

Fcb Details for FCB: 0x8394A140

SRC: 172.29.148.171-389 NAT: 172.29.149.146-389

DST: 172.29.148.170-15970 NAT: 172.29.97.219-14786

DMAC: 00-01-f4-16-e5-e6 SMAC: 00-0b-fd-be-c6-7d

IP Hdr ChkD: 12776 TCP/UDP Hdr ChkD: 13960

TCP SequenceD: 0 Task CE: 0

BytesIn: 246 Frames In: 4

Dest VLAN: 101 Src/Dst Ports: 0/0

Slot/SubSlot: 2/1 SmbQ/PrcSwP: 32/1

Time Stamp / Time Out Info:

CurSecs: 314997:428, started: 150399:756 last activity: 150399

May timeout due to inactivity: No , inactiveTimeout: 0

FCB Flags: 0x0119

0x0001 - Natting In Use

0x0000 - NOT L5 Aware

0x0000 - Non-Spoofed

0x0008 - IP/TCP Flow

0x0010 - Remote - Egress port

0x0100 - In LL List

0x0000 - Server-side

FCB FlaFlags: 0x8040

0x0040 - Is a static FCB

0x8000 - Handled an ACK

how could I interprete the following line of the Time Stamps ?

Time Stamp / Time Out Info:

CurSecs: 315164:145, started: 150399:756 last activity: 150399

my goal is to find a parameter to see how long the session is inactive !

regards

sascha

Cisco Employee

Re: CSS "flow display <flow identifier>" - timestamp

ok.

From the code.

CurSecs: 315164:145 means 315164sec and 145 msec.

Last activity means the time when a packet was seen last time in sec.

The time is a value in seconds since boot.

So you should do CurSecs - last activity to have the

idle time.

Gilles.

New Member

Re: CSS "flow display <flow identifier>" - timestamp

that looks fine.

thanks

sascha

149
Views
5
Helpful
4
Replies