1.
The ip accounting command records the number of bytes (IP header and data) and packets switched through the system on a source and destination IP address basis. Only transit IP traffic is measured and only on an outbound basis; traffic generated by the router access server or terminating in this device is not included in the accounting statistics.
If you specify the access-violations keyword, the ip accounting command provides information identifying IP traffic that fails IP access lists. Identifying IP source addresses that violate IP access lists alerts you to possible attempts to breach security. The data might also indicate that you should verify IP access list configurations.
To receive a logging message on the console when an extended access list entry denies a packet access (to log violations), you must include the log keyword in the access-list (IP extended) or access-list (IP standard) command.
Statistics are accurate even if IP fast switching or IP accesd lists are being used on the interface. If the access-violations keyword is specified and any IP access list is being used on an interface, then only process switching can generate accurate statistics (IP fast switching or CEF cannot).
IP accounting disables autonomous switching, SSE switching, and distributed switching (dCEF) on the interface. IP accounting will cause packets to be switched on the Route Switch Processor (RSP) instead of the Versatile Interface Processor (VIP), which can cause performance degradation.
http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124cr/hiap_r/apl_i1h.htm#wp1201321
_____________________
2. On the desired interface, this interface must hold an IP address
______________________
3. ip flow provides more information.
http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124cr/hnf_r/nfl_a1h.htm#wp1327831
