From: Vincent Mashburn (vmashburn@fedex.com)
Date: Wed Dec 14 2005 - 14:58:26 GMT-3
Try using nbar. It gives the 5-minute stats you are looking for.
Vince Mashburn
Engineer
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
Gustavo Novais
Sent: Wednesday, December 14, 2005 11:42 AM
To: Cisco certification
Subject: RE: IEWB3.0 lab 13 task 10.3 -- Netflow??
Just to add a output of sh ip cache verbose flow, on which we do not see
the 5 min average vs an ip accounting output.
Any suggestions?
Rack1R6#sh ip cache verbose flow
IP packet size distribution (36 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448
480
.000 .722 .000 .277 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
.000
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
IP Flow Switching Cache, 278544 bytes
0 active, 4096 inactive, 4 added
57 ager polls, 0 flow alloc failures
Active flows timeout in 30 minutes
Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 21640 bytes
0 active, 1024 inactive, 0 added, 0 added to flow
0 alloc failures, 0 force free
1 chunk, 1 chunk added
last clearing of statistics never
Protocol Total Flows Packets Bytes Packets Active(Sec)
Idle(Sec)
-------- Flows /Sec /Flow /Pkt /Sec /Flow
/Flow
TCP-Telnet 1 0.0 22 42 0.0 4.8
1.5
TCP-BGP 2 0.0 2 49 0.0 0.2
15.6
ICMP 1 0.0 10 100 0.0 1.8
15.1
Total: 4 0.0 9 59 0.0 1.7
12.0
SrcIf SrcIPaddress DstIf DstIPaddress Pr TOS
Flgs Pkts
Port Msk AS Port Msk AS NextHop B/Pk
Active
Rack1R6#
Rack1R6#sh ip accounting
Source Destination Packets Bytes
139.1.0.3 139.1.6.8 46 2801
Accounting data age is 9
Rack1R6#
Gustavo Novais
From: Gustavo Novais
Sent: quarta-feira, 14 de Dezembro de 2005 17:31
To: Cisco certification
Subject: IEWB3.0 lab 13 task 10.3 -- Netflow??
Hello
I'm having a doubt relatively to the interpretation of this question and
what should be its answer.
The question states:
"Your manager as expressed interest in finding out what kind of
application users on vlan X are using while at office. Configure R6 to
collect information about application traffic being sent to and received
from vlan X and store it locally.
This accounting should include both the total number of packets sent and
received as well as a 5 Minute utilization average."
According to this I see the keyword "application" meaning ports used,
therefore we are talking about flows. So, I can discard IP accounting
(that only accounts SrcIP DstIP, not full flow).
The problem is that by enabling netflow on the interface with ip flow
egress and ip flow ingress when I do sh ip cache flow I do not see the
"5minute utilization average".
Is my interpretation correct and we are talking about netflow here?
TIA
Gustavo Novais
This archive was generated by hypermail 2.1.4 : Mon Jan 09 2006 - 07:07:51 GMT-3