10-03-2006 07:53 AM - edited 03-05-2019 12:04 PM
A service policy on a fastethernet interface, with fair-queue in class-default, shows lots of packets in the class 0 and in the class 5, as shown here:
Class-map: class-default (match-any)
1069285238 packets, 1161214848048 bytes
30 second offered rate 33560000 bps, drop rate 0 bps
Match: any
Queueing
Flow Based Fair Queueing
Maximum Number of Hashed Queues 256
(total queued/total drops/no-buffer drops) 0/73/0
exponential weight: 9
class Transmitted Random drop Tail drop Minimum Maximum Mark
pkts/bytes pkts/bytes pkts/bytes thresh thresh prob
0 1067073173/1161070545754 7/10598 66/99924 20 40 1/10
1 0/0 0/0 0/0 22 40 1/10
2 0/0 0/0 0/0 24 40 1/10
3 0/0 0/0 0/0 26 40 1/10
4 0/0 0/0 0/0 28 40 1/10
5 1840665/117810962 0/0 0/0 30 40 1/10
6 372176/26817087 0/0 0/0 32 40 1/10 <<--------- ***
7 102/132812 0/0 0/0 34 40 1/10
rsvp 0/0 0/0 0/0 36 40 1/10
I need to find out what traffic is marked COS 5. Would using NBAR give me that info even if I need to have it search in the IP header's TOS field?
If NBAR will not do that, is there another way, using IOS commands, that I can determine the source of the traffic that is sending packets with the Class-of-service field of 5?
10-09-2006 08:48 AM
check out the following link, hope this helps :
http://www.ciscopress.com/articles/article.asp?p=101170&seqNum=3&rl=1
09-15-2015 02:24 AM
Hello
Posible match on the COS values of DSCP, however thinking about it, it wont give you the scr/dst addrressing
Another way could be to SPAN a specifc port and use wireshark to capture the traffic you desire
sh mls qos maps
Dscp-cos map:
dscp: 0 8 10 16 18 24 26 32 34 40 46 48 56
-----------------------------------------------
cos: 0 1 1 2 2 3 3 4 4 5 5 6 7
Cos-dscp map:
cos: 0 1 2 3 4 5 6 7
--------------------------------
dscp: 0 8 16 26 32 46 48 56
class-map match-any COS5_cm
match ip dscp cs5
policy-map COS5_pm
class COS5_cm
int x/x
service-policy input COS5_pm
res
Paul
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: