Several methods of traffic detection using routers

1. Configuration method

Router (config) #int s 0/0

Router (config-if) #ip accounting output-packets

Router#sh IP Accounting output-packets

Source Destination Packets Bytes

192.1.1.110 192.1.1.97 5 500

172.17.246 128 192.1.1.110 8 704

Accounting Data Age is 2d23h

Or

Router (config) #int s 0/0

Router (config-if) #ip accounting access-violations

Router#sh IP Accounting [checkpoint] Access-violations

Source Destination Packets Bytes ACL

192.1.1.110 224.0.0.5 46 3128 19

Accounting Data Age is 7

2, the description

This method should be used sparingly when the router is overloaded. Because it will degrade the system performance, the number of bytes based on address pairs and packet count; typically only outbound packets are supported, packets rejected by ACLs (ACLs that support in and out direction), only the traffic traversing the router is counted, The source or destination is that the packet of the router is not statistically available; supports all switching path except autonomous switching; the MIB is Old-cisco-ip-mib, and the value is accessed via SNMP. LIPACCOUNTINGTABLE;IP Accounting also supports other monitoring methods, such as tos,mac-address based.

Second, NetFlow

1. Configuration method

Router (config-if) #ip Route-cache Flow

Router (config) #ip flow-export destination 172.17.246.225 9996

Router (config) #ip Flow-export version 5

Optional Configuration

Router (config) #ip Flow-export source Loopback 0

Router (config) #ip flow-cache entries <1024-524288>

Router (config) #ip flow-cache timeout

SH IP Cache Flow

IP Packet Size distribution (132429191 total packets):

1-32 64 96 128, 160 192 224 256 288 320 352 384 416 448 480

.000.191.024.009.010.006.005.008.003.005.003.003.002.001 001

512 544 576 1024 1536 2048 2560 3072 3584 4096 4608

.001.002.107.032.578.000.000.000.000.000.000

IP flow switching Cache, 278544 bytes

In active, 4063 inactive, 7975259 added

104834714 ager polls, 0 flow alloc failures

Active flows timeout in minutes

Inactive flows timeout in seconds

Last clearing of statistics never

Protocol Total flows Packets Bytes Packets Active (sec) Idle (sec)

--------Flows/sec/flow/pkt/sec/flow/flow

Tcp-telnet 25378 0.0 12 652 0.0 22.9 15.2

Tcp-ftp 432435 0.1 4 59 0.4 1.2 2.7

tcp-ftpd 28670 0.0 212 1397 1.4 8.2 1.6

Tcp-www 4682530 1.0 15 927 16.4 2.4 4.6

2, the description

Statistics are based on flow (including address pairs, port number, protocol type, etc.), support only inbound traffic, only unicast, only primary port configuration, and CEF or fast switching, and router performance.

10,000 active flows: < 4% of additional CPU utilization

45,000 active flows: <12% of additional CPU utilization

65,000 active flows: <16% of additional CPU utilization