Show Commands

collector

Syntax

collector [ip-addr[:port]] [detail]

Context

show>cflowd

Description

This command displays administrative and operational status of data collector configuration.

Parameters

ip-addr

Display only information about the specified collector IP address.

Default

all collectors

:port

Display only information the collector on the specified UDP port.

Default

all UDP ports

Values

1 — 65535

detail

Displays details about either all collectors or the specified collector.

Output

cflowd Collector Output

The following table describes the show cflowd collector output fields:

 

Table 20: Show Cflowd Collector Output Fields  

Label	Description
Host Address	The IP address of a remote Cflowd collector host to receive the exported Cflowd data.
Port	The UDP port number on the remote Cflowd collector host to receive the exported Cflowd data.
AS Type	The style of AS reporting used in the exported flow data.
	origin Reflects the endpoints of the AS path which the flow is following.
	peer Reflects the AS of the previous and next hops for the flow.
Version	Specifies the configured version for the associated collector.
Admin	The desired administrative state for this Cflowd remote collector host.
Oper	The current operational status of this Cflowd remote collector host.
Recs Sent	The number of Cflowd records that have been transmitted to this remote collector host.
Collectors	The total number of collectors using this IP address.

 

 

Sample Output

A:SR1 # show cflowd collector detail

===============================================================================

Cflowd Collectors (detail)

===============================================================================

Address : 138.120.135.103

Port : 2055

Description : Test v9 Collector

Version : 9

Admin State : up

Oper State : up

Packets Sent : 51

Last Changed : 09/03/2009 17:24:04

Last Pkt Sent : 09/03/2009 18:07:10

Template Set : Basic

-------------------------------------------------------------------------------

Traffic Type       Template Sent           Sent       Open       Errors

-------------------------------------------------------------------------------

IPv4               09/03/2009 18:07:29      51                 1           0

MPLS               No template sent          0                 0           0

IPv6               No template sent          0                 0           0

===============================================================================

A:R51-CfmA# show cflowd collector 

===============================================================================

Cflowd Collectors 

===============================================================================

Host Address    Port  Version   AS Type   Admin   Oper            Sent         

-------------------------------------------------------------------------------

138.120.135.103 2055  v5        peer      up      up              1380 records 

138.120.135.103 9555  v8        origin    up      up                90 records 

138.120.135.103 9996  v9          -       up      up                 0 packets 

138.120.214.224 2055  v5        origin    up      up              1380 records 

-------------------------------------------------------------------------------

Collectors : 4

===============================================================================

 

Table 21: Show Cflowd Collector Detailed Output Fields  

Label	Description
Address	The IP address of a remote Cflowd collector host to receive the exported Cflowd data.
Port	The UDP port number on the remote Cflowd collector host to receive the exported Cflowd data.
Description	A user-provided descriptive string for this Cflowd remote collector host.
Version	The version of the flow data sent to the collector.
AS Type	The style of AS reporting used in the exported flow data.
	origin Reflects the endpoints of the AS path which the flow is following.
	peer Reflects the AS of the previous and next hops for the flow.
Admin State	The desired administrative state for this Cflowd remote collector host.
Oper State	The current operational status of this Cflowd remote collector host.
Records Sent	The number of Cflowd records that have been transmitted to this remote collector host.
Last Changed	The time when this row entry was last changed.
Last Pkt Sent	The time when the last Cflowd packet was sent to this remote collector host.
Aggregation Type	The bit mask which specifies the aggregation scheme(s) used to aggregate multiple individual flows into an aggregated flow for export to this remote host collector.
	none No data will be exported for this remote collector host.
	raw Flow data is exported without aggregation in version 5 format.
	All other aggregation types use version 8 format to export the flow data to this remote host collector.
Collectors	The total number of collectors using this IP address.
Sent	The number of packets with flow date sent to the associated collector.
Open	This counter shows the number of partially filled packets which have some flow data but are not yet filled or have been timed out (60 seconds maximum).
Error	This counter increments when there was an error during exporting of the collector packet. The most common reason will be a UDP unreachable destination for the configured collector.

A:R51-CfmA# show cflowd collector detail 

===============================================================================

Cflowd Collectors  (detail)

===============================================================================

Address                      : 138.120.135.103

Port                         : 2055

Description                  : Test v5 Collector

Version                      : 5

AS Type                      : peer

Admin State                  : up

Oper State                   : up

Records Sent                 : 1260

Last Changed                 : 09/03/2009 17:24:04

Last Pkt Sent                : 09/03/2009 18:07:10

-------------------------------------------------------------------------------

                                               Sent          Open       Errors 

-------------------------------------------------------------------------------

                                                 42             0            0

===============================================================================

Address                      : 138.120.135.103

Port                         : 9555   

Description                  : Test v8 Collector

Version                      : 8

AS Type                      : origin

Admin State                  : up

Oper State                   : up

Records Sent                 : 82

Last Changed                 : 09/03/2009 17:24:04

Last Pkt Sent                : 09/03/2009 18:06:41

-------------------------------------------------------------------------------

Aggregation Type              Status           Sent          Open       Errors 

-------------------------------------------------------------------------------

as-matrix                    Disabled             0             0            0

protocol-port                Disabled             0             0            0

source-prefix                 Enabled            21             0            0

destination-prefix            Enabled            21             0            0

source-destination-prefix    Disabled             0             0            0

raw                          Disabled             0             0            0

===============================================================================

Address                      : 138.120.135.103

Port                         : 9996

Description                  : Test v9 Collector

Version                      : 9

Admin State                  : up

Oper State                   : up

Packets Sent                 : 51

Last Changed                 : 09/03/2009 17:24:04

Last Pkt Sent                : 09/03/2009 18:07:10

Template Set                 : Basic

-------------------------------------------------------------------------------

Traffic Type            Template Sent          Sent          Open       Errors 

-------------------------------------------------------------------------------

IPv4              09/03/2009 18:07:29            51             1            0

MPLS                 No template sent             0             0            0

IPv6                 No template sent             0             0            0

===============================================================================

A:R51-CfmA# 

interface

Syntax

interface [ip-addr | ip-int-name]

Context

show>cflowd

Description

Displays the administrative and operational status of the interfaces with cflowd enabled.

Parameters

ip-addr

Display only information for the IP interface with the specified IP address.

Default

all interfaces with cflowd enabled.

ip-int-name

Display only information for the IP interface with the specified name.

Default

all interfaces with cflowd enabled.

 

Output

cflowd Interface Output

The following table describes the show cflowd interface output fields.

Label	Description
Interface	Displays the physical port identifier.
IPv4 Address	Displays the primary IPv4 address for the associated IP interface.
IPv6 Address	Displays the primary IPv6 address for the associated IP interface.
Router	Displays the virtual router index (Base = 0).
IF Index	Displays the Global IP interface index.
Mode	Displays the cflowd sampling type and direction. intf — Interface based sampling acl — ACL based sampling ingr — Ingress sampling egr — Egress sampling both — Both ingress and egress sampling
Admin	Displays the administrative state of the interface.
Opr-IPv4	Displays the operational state for IPv4 sampling.
Opr-IPv6	Displays the operational state for IPv6 sampling.

Sample Output

B:sr-002# show cflowd interface [ip-addr | ip-int-name] 

===============================================================================

Cflowd Interfaces

===============================================================================

Interface                         Router       IF Index   Mode      Admin  

  IPv4 Address                                                        Oper IPv4

  IPv6 Address                                                        Oper IPv6

-------------------------------------------------------------------------------

ipv4ipv6NamedIf                   Base          381       intf/ing   Up

    5.5.5.5/24                                                        Up         

    55::55/128                                                        Up

ipv4NamedIf                       5             254       acl-egr   Up   

    10.10.10.10/24                                                    Up

    N/A                                                               Down

ipv6NamedIf                       Base          380       i/f-both  Up   

    N/A                                                               Down

    1234:5678::9/128                                                  Up

-------------------------------------------------------------------------------

Interfaces : 3

===============================================================================

B:sr-002# show cflowd interface 11.10.1.2

===============================================================================

Cflowd Interfaces

===============================================================================

Interface:  To_Sr1

IP address: 11.10.1.2/24

Admin/Oper state:  Up/Up

Sampling Mode: (ingress | egress | both)

Total Flows seen: 1302000

Pkts sampled (ingress/egress) :  60103/70102  

Bytes sampled (ingress/egress) :  6010300/7010200  

Active flows (ingress/egress) :  6010/7010    

B:sr-002# show cflowd interface

===============================================================================

Cflowd Interfaces

===============================================================================

Interface                         IP Address        Mode        Admin   Oper

-------------------------------------------------------------------------------

To_Sr1                            1.10.1.2/24       Interface   Up      Up

To_C2                             1.12.1.2/24       Interface   Up      Up

To_Cisco_7600                     1.13.1.2/24       Interface   Up      Up

To_E                              1.11.1.2/24       Interface   Up      Up

To_G2                             150.153.1.1/24    Interface   Up      Up

To_Sr1_Sonet                      150.140.1.2/24    Interface   Up      Down

Main                              120.1.1.1/24      Filter      Down    Down

New                               120.2.1.1/24      Filter      Up      Up

-------------------------------------------------------------------------------

Interfaces : 8

===============================================================================

B:sr12-002#

status

Syntax

status

Context

show>cflowd

Description

This command displays basic information regarding the administrative and operational status of cflowd.

Output

cflowd Status Output

The following table describes the show cflowd status output fields:

 

Table 22: Cflowd Status Output  

Label	Description
Cflowd Admin Status	The desired administrative state for this Cflowd remote collector host.
Cflowd Oper Status	The current operational status of this Cflowd remote collector host.
Active Timeout	The maximum amount of time, in minutes, before an active flow will be exported. If an individual flow is active for this amount of time, the flow is exported and a new flow is created.
Inactive Timeout	Inactive timeout in seconds.
Template Retransmit	The time in seconds before template definitions are sent.
Cache Size	The maximum number of active flows to be maintained in the flow cache table.
Overflow	The percentage number of flows to be flushed when the flow cache size has been exceeded.
Sample Rate	The rate at which traffic is sampled and forwarded for Cflowd analysis. one (1) All packets are analyzed. 1000 (default) Every 1000th packet is analyzed.
Active Flows	The current number of active flows being collected.
Total Pkts Rcvd	The total number of packets sampled and forwarded for Cflowd analysis.
Total Pkts Dropped	The total number of packets dropped.
Aggregation Info:
Type	The type of data to be aggregated and to the collector.
Status	enabled Specifies that the aggregation type is enabled.
	disabled Specifies that the aggregation type is disabled.
Sent	The number of packets with flow date sent to the associated collector.
Open	This counter shows the number of partially filled packets which have some flow data but are not yet filled or have been timed out (60 seconds maximum).
Error	This counter increments when there was an error during exporting of the collector packet. The most common reason will be a UDP unreachable destination for the configured collector.
Overflow events	The number of times the active cache overflowed.
Dropped Flows	Total number of flows dropped due to cache overflow events.

Sample Output

sr1# show cflowd status

===============================================================================

Cflowd Status

===============================================================================

Cflowd Admin Status : Enabled

Cflowd Oper Status : Enabled

Active Timeout : 1 minutes

Inactive Timeout : 30 seconds

Template Retransmit : 60 seconds

Cache Size : 65536 entries

Overflow : 1%

Sample Rate : 1

Active Flows : 34000

Overflow events 10 

Dropped Flows: 0 

Pkts Rcvd : 801600

Total Pkts Dropped : 0

                           Raw          

Times flow created        160000           

Times flow matched        224428382        

Total flows flushed       150000           

===============================================================================

Version Info

===============================================================================

Version       Status        Sent   Open   Errors

-------------------------------------------------------------------------------

5             Enabled       92     0      0

8             Enabled       46     0      0

9             Enabled       56     1      0

10            Enabled       39     1      0

===============================================================================

===============================================================================

Cflowd Status

===============================================================================

Cflowd Admin Status  : Enabled

Cflowd Oper Status   : Enabled

Active Timeout       : 1 minutes

Inactive Timeout     : 30 seconds

Template Retransmit  : 60 seconds

Cache Size           : 65536 entries

Overflow             : 1%

Sample Rate          : 1

Active Flows         : 34

Total Pkts Rcvd      : 801600

Total Pkts Dropped   : 0

===============================================================================

Version Info

===============================================================================

Version                    Status     Sent          Open          Errors       

-------------------------------------------------------------------------------

     5                     Enabled    92            0             0            

     8                     Enabled    46            0             0            

     9                     Enabled    56            1             0            

    10                     Enabled    39            1             0            

=============================================================================== 

 

Tools Commands

cache

Syntax

cache {all | aggregate {src-dst-proto | src-dst-proto-port}} family {ipv4 | ipv6}

Context

tools>dump>cflowd

Description

This command displays the contents of the CFLOWD active cache. This information can be displayed either in raw form where every flow entry is displayed or in an aggregated form.

Parameters

all

Display the raw active cache flow data with no aggregation.

aggregate

Display the aggregated active cache flow data.

src-dst-proto — Aggregates the active flow cache based on the source and destination IP address and the IP protocol value.

src-dst-proto-port — Aggregates the active flow cache based on the source and destination IP address, IP protocol value, and the source and destination port numbers.

family

Specifies which IP address family flow data should be displayed.

ipv4 — Displays the IPv4 flow data.

ipv6 — Displays the IPv6 flow data.

Output

tools dump cflowd cache Output

The following table describes the tools dump cflowd cache output fields:

 

Table 23: tools dump cflowd cache Output Fields

Label	Description
Proto/Protocol	Displays the IPv4 or IPv6 protocol type.
Source Address/Src-IP	Displays the source IP address of the flow (IPv4 or IPv6).
Destination Address/Dst-IP	Displays the destination IP address of the flow (IPv4 or IPv6).
Intf/Ingr	Displays the ingress interface associated with the sampled flow (only displayed with the raw (all) output).
Intf/Egr	Displays the egress interface associated with the sampled flow (only displayed with the raw (all) output).
S-Port	Displays the source protocol port number.
D-Port	Displays the destination protocol port number.
Pkt-Cnt	Displays the total number of packets sampled for the associated flow.
Byte-Cnt	Displays the total number of bytes of traffic sampled for the associated flow.
Start-Time	Displays the system time when the first packet was sampled for the associated flow.
Flags	Displays the IP flag value from the sampled IP flow header (only displayed with the raw (all) output).
ToS	Displays the ToS byte values from the sampled IP flow header (only displayed with the raw (all) output).
(Src) Mask	Displays the IP route mask for the route to the flow source IP address associated with the flow (only displayed with the raw (all) output).
(Dst) Mask	Displays the IP route mask for the route to the flow destination IP address associated with the flow (only displayed with the raw (all) output).
(Src) AS	Displays the ASN associated with the route to the flow source IP address associated with the flow (only displayed with the raw (all) output).
(Dst) AS	Displays the ASN associated with the route to the flow destination IP address associated with the flow (only displayed with the raw (all) output).
vRtr-ID	Displays the Virtual Router ID associated with the reported IP flow (only displayed with the raw (all) output).

packet-size

Syntax

packet-size [ipv4 | ipv6] [clear]

Context

tools>dump>cflowd

Description

This command displays packet size distribution for sampled IP traffic. Values are displays in decimal format (1.0 = 100%, .500 = 50%). Separate statistics are maintained and shown for IPv4 and IPv6 traffic.

Sample Output

SR-12# tools dump cflowd packet-size ipv4

 IP packet size distribution (801600 total packets):

   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480

   .000 .250 .000 .000 .010 .100 .500 .090 .000 .000 .000 .000 .000 .000 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608 9000

   .000 .000 .000 .050 .000 .000 .000 .000 .000 .000 .000 .000

top-flows

Syntax

top-flows [ipv4 | ipv6 | mpls] [clear]

Context

tools>dump>cflowd

Description

This command displays the top 20 (highest traffic volume) flows for IPv4, IPv6 or MPLS traffic types collected since the cflowd top-flow table was last cleared or initialized.

Output

Tools Dump Cflowd Top-Flows Output

The following table describes the tools dump cflowd top-flows output fields:

 

Table 24: Tools Dump Cflowd Top-flows Out put Fields

Label	Description
Ingress	Displays the ingress interface ID.
Src IP	Displays the source IP address of the flow (IPv4 or IPv6).
Egress	Displays the egress interface ID.
Dest IP	Displays the destination IP address of the flow (IPv4 or IPv6).
Pr Proto	Displays the protocol type for flow.
TOS	Displays the Type of Service/DSCP buts filed markings.
Flgs	Displays the protocol flag markings.
Pkts	Displays the total number of packets sampled for this flow (since stats were last cleared).
vRtr-ID	Displays the vRouter context the flow was sample in.
S-Port Src Port	Displays the source protocol port number.
Msk	Displays the route prefix length for route to source IP address.
AS	Displays the Autonomous Systems number for the source route (the AS is either originating AS or peer AS depending on cflowd configuration).
D-Port Dst Port	DIsplays the destination protocol port number.
Msk	Displays the route prefix length for route to destination IP address (Forwarding route).
AS	Displays the Autonomous Systems number for the destination route (the AS is either originating AS or peer AS depending on cflowd configuration)
Nexthop	Displays the next-hop address used to forward traffic associated with the flow.
Avg pkt size	Displays the average packet size of a sampled traffic associated with this flow (total number of packets sampled / total number of packets sampled).
Active	Displays the number of seconds the flow has been active.

 

Sample Output

1         2         3         4         5         6         7         8

Sr1# tools dump cflowd top-flows ipv4

Ingress i/f   SrcIP          Egress i/f     DstIP           Pr  TOS  Flgs  Pkts

 vRtr-ID   S-Port Msk AS     D-Port Msk AS  NextHop         Avg Pkt Size Active

----------------------------------------------------------------------------------

1000          52.52.52.1      2001          123.123.123.122 0x01 55   0x10  3748 

 10201     0000   /8  50         0000 /8  40  202.120.130.2       220     3600

……

         1         2         3         4         5         6         7         8

Sr1# tools dump cflowd top-flows ipv6

SrcIP (up to IPv6)                       Ingress i/f  Src Port   vRtr ID     ToS    

DstIP (upto IPv6)                        Egress i/f   Dst Port    Proto    Flags 

   Nexthop (uptoIPv6)                      Total Pkts     Avg Pkt  Active(sec)   

2001:0db8:85a3:0000:0000:8a2e:0370:7334  60005        10020        0        0x12

2001:0db8:85a3:0000:0000:8a2e:0280:1234  60325        20010        17       0x23

   2001:0db8:85a3:0000:0000:8a2e:1234:5678 1234567890     1500     13600      

…… 

         1         2         3         4         5         6         7         8

Sr1# tools dump cflowd top-flows mpls

Label-1    Label-2    Label-3    Label-4    Total Pkts     Avg Pkt   Active(s)

  SrcIP (up to IPv6)                    Ingress i/f  Src Port    ToS    

  DstIP (upto IPv6)                     Egress i/f   Dst Port    Proto    Flags 

--------------------------------------------------------------------------------

top-protocols

Syntax

top-protocols

Context

tools>dump>cflowd [clear]

Description

This command displays the summary information for the top 20 protocol traffic seen in the cflowd cache. All statistics are calculated based on the data collected since the last clearing of the cflowd stats with clear keyword for this command.

If the clear optional keyword is given, then the top-flows are displayed, and then this cache is cleared.

Output

Tools Dump Cflowd Top-protocols Output

The following table describes the tools dump cflowd top-protocols output fields:

 

Table 25: Tools Dump Cflowd Top-protocols Output Fields

Label	Description
Protocol ID	Displays the IPv4 or IPv6 protocol type. This will either print the well known protocol name or the decimal protocol number.
Total Flows	Displays the total number of flows recorded since the last clearing of cflowd statistics with this protocol type.
Flows/Sec	Displays the average number of flows detected for the associated protocol type. (Total flows / number of seconds since last clear)
Packets/Flow	Displays the average number of packets per flow. (Total number of packets / total flows)
Bytes/Pkts	Displays the average number of bytes per packet for the associated protocol type. (Total number of bytes for the associated protocol / total number of packets seen for the associated protocol)
Packets/Sec	Displays the average number of packets seen for the associated protocol type. (Number of packets / time since last clear)
Duration/Flow	Displays the average lifetime of a flow for the associated protocol type. (Number of seconds since last clear / total flows)
Bandwidth Total (%)	Displays the percentage of bandwidth consumed by the associated protocol type. (Total protocol bytes / total bytes of all flows)

Sample Output

SR# tools dump cflowd top-protocols 

The top 20 IPv4 protocols seen by cflowd are:

      Current Time: 08/29/2011 15:36:15

Last Cleared Time: 08/29/2011 15:35:08

Protocol ID     Total   Flows   Packets   Bytes   Packets   Duration   % Total

--------        Flows    /Sec     /Flow    /Pkt      /Sec      /Flow   Bandwidth

--------------------------------------------------------------------------------

UDP                 2       0         6     100         0          6         75%

pr1                   1       0         6      64         0          6         24%

--------------------------------------------------------------------------------

TOTALS              3       0         6      88         0          6        100%

 

Clear Commands

cflowd

Syntax

cflowd

Context

clear

Description

Clears the raw and aggregation flow caches which are sending flow data to the configured collectors. This action will trigger all the flows to be discarded. The cache restarts flow data collection from a fresh state. This command also clears global stats collector stats listed in the cflowd show commands.