cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2228
Views
20
Helpful
5
Replies

ip flow top-talkers * indication

snarayanaraju
Level 4
Level 4

Hi Friends - I am trying to findout what astreik (*) indicates in the command "show ip flow top-talkers".

I read in the command reference that The asterisk (*) immediately following the "DstIf" field indicates that the flow being shown is an egress flow.

But i see the same 2 flows (having the same source, destination, destination interface), one showing with * and other donot. Can you please explain the why it please

rtr1#show ip flow top-talkers

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP Bytes
Po1.2         10.212.16.45    Se0/3/0.777*  172.22.49.41    06 2F30 FA96   317K
Po1.2         10.212.16.45    Se0/3/0.777   172.22.49.41    06 2F30 FA65   310K
Po1.2         10.212.16.45    Se0/3/0.777   172.22.49.41    06 2F30 FA69   219K
Po1.2         10.212.16.45    Se0/3/0.777*  172.22.49.41    06 2F30 FA69   180K
10 of 10 top talkers shown. 1293 flows processed.

Thanks in advance

SAIRAM

5 Replies 5

John Blakley
VIP Alumni
VIP Alumni

The * means that it's an egress flow:

DstIf

Interface from which the packet was transmitted.

Note: If an asterisk (*) immediately follows the DstIf field, the flow being shown is an egress flow.

HTH,
John

*** Please rate all useful posts ***

HTH, John *** Please rate all useful posts ***

Hi John Thank you for the response.

Though i can understand that * means egress flow, where i got confused is, why the first line of the below output having *, whereas the next line doesn't have, thougt the traffic pattern is same .

rtr1#show ip flow top-talkers

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP Bytes
Po1.2         10.212.16.45    Se0/3/0.777*  172.22.49.41    06 2F30 FA96   317K
Po1.2         10.212.16.45    Se0/3/0.777   172.22.49.41    06 2F30 FA65   310K

regards,

SAIRAM

It could be because the etherchannel is the source and it could possibly coming over a different link in the channel group, but it's still in the egress direction, so I'm not sure why you wouldn't have the * listed.

HTH,

John

HTH, John *** Please rate all useful posts ***

Vishesh Verma
Level 1
Level 1

Hi,

I am assuming that you config is like this

!

int Po1.2

ip flow ingress

!

int Se0/3/0.777

ip flow egress

!

Now the same flow is going to be captured by both of these interfaces. One with the * is the flow that is captured by the ip flow egress command on the Serial link.

Hope that answers your question.

-Vishesh

Hi John & Vishesh - Thank you for your expert response

Here is the configuration i have taken from the same router

interface Serial0/3/0.777 point-to-point
ip flow ingress
ip flow egress
end

interface Port-channel1.2
ip flow ingress
end

regads,

SAIRAM

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco