Show ip flow top-talkers
what happened to this command in the new IOS 15.1(1) with flexflow;
sh ip flow top-talkers...
Thanks,
Sinan
Hi Maicon,
Under "ip flow-top-talkers", you need to configure "sort-by" as it's required to run top-talkers command.
Yoong Seong
Similar Messages
-
"show ip flow top-talkers" output question
Hello all,
I have a question about the "show ip flow top-talkers" command. The top enry for this 1841 router with a T1 connection is always this line:
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Bytes
Se0/1/0 64.32.253.138 Local 71.16.240.14 32 6EB0 306B 2366K
How do I get more information about this connection? I looked at ip protocol 32 and it says it is the MERIT Internodal Protocol. Also what does the bytes field mean? Is that bytes per second or per "flow"?Hello,
protocol is 0x32 (in hex) = 50 (dec). This protocol is ESP. I assume, this flow is an IPSEC tunnel.
The endpoint is your device (regarding to dest interface = local). The "Bytes" field means number of
bytes in the flow. It is not releated to bytes/sec. Please, feel free to contact me if you need more
information.
Kind regards,
Jan Nejman
Caligare, co.
http://www.caligare.com/ -
Does WCCP skew results of 'ip flow top-talkers'?
I have a router that has been configured to show ip flow top-talker information. I recently added a WAAS to this site that is using WCCP redirection. The 'top-talkers' output on the router still works - but shows source/destination of the router and WAAS device as the talkers for all traffic that has been redirected. I'm not able to see that actual client IPs for that traffic .. and that is the majority of my traffic. Is there any way to still be able to view this traffic as I did before? If I dump netflow to an actual netflow server instead of using top-talkers will that work - or will it display the same thing?
Router configuration:
interface multilink1
ip flow ingress
interface gi0/0
ip flow ingress
ip flow-top-talkers
top 25
sort-by bytes
Now when I do a 'show ip flow top-talkers', here's what I see: 10.10.11.18 is WAAS and 10.10.255.11 is loopback of the router.
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Bytes
Gi0/0.1 10.10.11.18 Mu1 10.10.255.11 2F 0000 0000 141M
Gi0/0.1 10.10.11.18 Mu1 10.10.255.11 2F 0000 0000 12M
Gi0/0.1 10.10.11.124 Gi0/0.1 10.10.10.53 06 1058 0A26 1801K
Gi0/0.1 10.10.11.54 Gi0/0.1 10.10.10.5 06 0E0C 0A26 882K
Gi0/0.1 10.10.11.107 Gi0/0.1 10.10.10.50 06 043D 05D6 736K
Gi0/0.1 10.10.11.60 Gi0/0.1 10.10.10.5 06 0409 0A26 723K
Gi0/0.1 10.10.11.103 Gi0/0.1 10.10.10.5 06 0407 0A26 713K
Gi0/0.1 10.10.11.120 Gi0/0.1 10.10.10.14 06 0456 05D6 531K
Gi0/0.1 10.10.11.237 Gi0/0.1 10.10.10.27 06 238C 110E 527K
Gi0/0.1 10.10.11.62 Gi0/0.1 10.10.10.53 06 C00E 05D6 463K
Gi0/0.1 10.10.11.125 Gi0/0.1 10.10.10.30 06 12A1 1F90 355K
Gi0/0.1 10.10.11.115 Gi0/0.1 10.10.10.14 06 042C 05D6 336K
Gi0/0.1 10.10.11.137 Gi0/0.1 10.10.10.6 06 04AC 0D3D 244K
Gi0/0.1 10.10.11.154 Gi0/0.1 10.10.10.53 06 0A0D 0A26 216K
Gi0/0.1 10.10.11.66 Gi0/0.1 10.10.10.6 06 C018 05D6 195K
Gi0/0.1 10.10.11.91 Gi0/0.1 10.10.10.5 06 0439 05D6 145K
Gi0/0.1 10.10.11.58 Gi0/0.1 10.10.10.14 06 0458 05D6 134K
Gi0/0.1 10.10.11.127 Gi0/0.1 10.10.10.30 06 0618 1F90 115K
Gi0/0.1 10.10.11.18 Local 10.10.255.11 11 0800 0800 96K
Gi0/0.1 10.10.11.147 Gi0/0.1 10.10.10.14 06 118F 0A26 88K
Gi0/0.1 10.10.11.95 Gi0/0.1 10.10.10.14 06 0C35 0D3D 84K
Gi0/0.1 10.10.11.105 Gi0/0.1 10.10.10.27 06 C98F 01BD 70K
Gi0/0.1 10.10.11.117 Gi0/0.1 10.10.10.53 06 CB1A 0D3D 41K
Gi0/0.1 10.10.11.65 Gi0/0.1 10.10.10.14 06 0EF9 05D6 40K
Gi0/0.1 10.10.11.112 Gi0/0.1 10.10.10.21 06 08D5 0D3D 37K
Thanks!I believe the problem is caused because I have the WAAS appliance in the same subnet as users. I am using the 'egress-method negotiated-return intercept-method wccp' on the WAAS to send the traffic back to the router. This uses GRE, which is causing the cache flow data to show up the way it is.
I will have to move the WAAS to a different subnet and change the return method. -
Cannot config "ip flow-top-talkers" on 7606-S
We have a router 7606-S is running IOS 12.2 (33r) SRD2 and Internet BGP protocol.
I tried to enable Flow Top Talkers on it to check Top 10 flow talkers.
1.configure interface:
Router(config-if)#ip flow ingress
2.configure
Router(config)#ip flow-top-talkers
but it shows:
Router((config)#ip flow-top-talkers
^
% Invalid input detected at '^' marker.
Router(config)#ip flow-?
flow-aggregation flow-cache flow-capture flow-egress flow-export
I then tried command
Router#show ip flow top-talkers
% Top talkers not configured
Can anyone advice if anything I miss please?
Thanks in advance.Does your switch have a network services module installed?
Note Flexible NetFlow is supported only on the Catalyst 3750-X and 3560-X switch running the IP base or IP services feature set and equipped with the network services module. It is not supported on switches running the NPE or the LAN base image. -
So I stumbled upon the ip flow-top-talkers feature and attempted to configure it on a 3560-X running 12.2(58)SE2. It allowed me to configure this:
ip flow-top-talkers
top 5
sort-by bytes
cache-timeout 60000
Then on the interface I am interested in:
interface GigabitEthernet0/21
ip flow ingress
Which results is (drum roll please....)
Switch#show ip flow top
% Cache is empty
No joy. So I checked the config guide for unsupported commands, these are not listed.
Then I thought maybe it had to be on a layer 3 interface (g0/21 is layer 2) so I did "ip flow ingress" on an SVI, same results.
So then I checked feature navigatore for "Flexible Netflow - Top N Talkers Support". 12.2SE is not listed, but 15.0(2)SE is.
Questions:
- Is the existence of the commands in 12.2(58)SE just an oversight? Functionality seems to almost be there, just not quite.
- Does neflow need to be enabled on a layer 3 interface or will it work on layer 2 (assuming platform support of course)
Thanks,
-JeffDoes your switch have a network services module installed?
Note Flexible NetFlow is supported only on the Catalyst 3750-X and 3560-X switch running the IP base or IP services feature set and equipped with the network services module. It is not supported on switches running the NPE or the LAN base image. -
Hi All,
i would like to enable "ip flow-top-talkers" in 6500 in native mode.
this command is not supported in current version.
is there any alernative command or it won't support.
running ios is s72033-pk9sv-mz.122-18.SXD5.bin
Thanx in advance for the response.
Regards,
RajeshThis command was introduced only from 12.2(25)S and this feature was integrated into 12.3(11)T. So,if you are using any lower version other than this,this command will not work at all.If possible,better download any of the above 2 versions from cisco website and upgrade your IOS.
-
Cisco2821 - ip flow top talkers = cache is empty
Hi Everyone,
I've been fighting an issue with a 2821 router for some time now. I'm trying to pull the top talkers from an interface, however the cache is empty. I verified the configuration with a known working 2821 and the output for the interfaces are the same. Any help would be greatly appreciated!
NON-WORKING:::
interface GigabitEthernet0/0
description P2P Comcast NLAN to ENET
ip address 10.103.2.6 255.255.255.0
ip flow ingress
ip flow egress
duplex full
speed 100
interface GigabitEthernet0/1
description connect to JDR_3560_2
ip address 10.200.12.1 255.255.255.0
duplex auto
speed auto
interface Serial0/1/0
no ip address
shutdown
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
no ip http server
no ip http secure-server
ip flow-cache timeout active 1
ip flow-export source GigabitEthernet0/0
ip flow-export version 5
ip flow-export destination 10.100.1.58 2055
ip flow-top-talkers
top 25
sort-by bytes
logging 10.100.1.17
logging 10.100.1.119
WORKING CONFIG:
interface GigabitEthernet0/0
description Comcast MetroEthernet CID: 54.VLXP.006454.CPLC
ip address 10.103.2.5 255.255.255.0
ip flow ingress
ip flow egress
ip pim sparse-dense-mode
ip igmp query-interval 125
duplex full
speed 100
service-policy output WAN-EDGE
ip flow-cache timeout active 1
ip flow-export source GigabitEthernet0/0
ip flow-export version 5
ip flow-export destination 10.100.6.111 2055
ip flow-export destination 10.100.1.58 2055
ip flow-top-talkers
top 30
sort-by bytes
ip mroute 0.0.0.0 0.0.0.0 10.103.2.240
logging 10.100.1.17
logging 10.100.1.40
logging 10.100.1.119Hi,
I'm not a Netflow expert by let's try; config seems to be correct, could you post the output of
sh ip flow export
sh ip flow top-talker
sh ver
enrico -
Hi Folks,
I was trying to use the top talkers feature to find the culprits hogging my bandwidth. I am pertty new top talker feature and its implemented on a 6500 with sup720. I have a couple of queries w.r.t this.
* tried to configure the cort by bytes feature got a warning that its not supported on the hardware based model.So is there any way to use sort by bytes on the sup 720?
* The O/P fileds of a show ip flow top-talkers are usually,
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts( had to use sort by packets due to warning)
Now is this pkts field the number of packets calculated between the cache-timeout value or is it the total seen so far? Will it be the same for sort by bytes too? Total bytes seen for this flow rather than a realtime bytes/sec or bytes/cache time-out value.
If this is the case then its actually not a real time top talker value right? Please help
Thanks,
PrakadeeshThe --command -- sh ip cache flow shows the cache-timeout value only not the collective bytes of data ; if you need the Total bytes seen for this flow you need to use the Crannog netflow Tracker kind of tools or you need to use " ip accounting " and clear the counter manually as and when required !!!
And it its actually a real time top talker value for that specifed cache-timeout value and i found most of the time it shows the correct top-talker many times !!!!!!!!!!!!!!!!!!! -
Netflow top-talkers configuration
Hello
I would like to know the purpose of these configuration commands :
ip flow-top-talkers
top 50
sort-by packets
cache-timeout 2000
match source address 192.1.1.97/32
match destination address 192.1.1.110/32
This is extracted from a documentation from Cisco.
For me there is no sense to configure a top talkers : how do we know that this will be the top talkers ?
Thanks for help
RegardsTop talkers are based on the conversations or flows generating the heaviest traffic on your routing device. A flow refers to traffic from source A to source B through any interface of the router and "heaviest traffic" means volume of traffic generated. They can be sorted based on any one of the following criteria:
1. By the total number of packets in each top talker
2. By the total number of bytes in each top talker
There are further filter options, which can done using "match statements".
For eg, if you simply enable top talkers for 50 and set the sort feature based on packets, the 50 conversations who were sending the most traffic (volume - KB, MB, GB) will be taken and displayed. The displayed conversations will be sorted based on the packet counts in the flow.
If you add an match IP source statement to the above example, then the same as above is done but only flows whose source IP is the same as in the match statement is captured.
If you add a match source and destination IP, then only the top 50 flows between those 2 IP Addresses will be captured and displayed.
Regards,
Don Thomas Jacob
www.netflowanalyzer.com
NOTE: Please rate posts and close questions if you have got the answer. -
ASA5505 - IP FLOW TOP or IP Accounting
How does one find the top user or IP accounting with this ASA5505 v7.22 device?
With 1841 ISR:
sh ip accounting
sh ip flow top
Very lame if they don't have similar commands or capabilities on the ASA series.David,
The version that you are running is very old. The IP accounting Im not sure what it does, but the show IP flow, I am almost 99% sure that it has to do with Netflow, which was introduced on the ASA in version 8.2 and higher.
Just looked for the IP accounting and mostlikely, all that you are asking for is implemented on Netflow, here is more info:
https://supportforums.cisco.com/docs/DOC-6114
You can upgrade to 8.2.1 not having to do much of a change, now that you know that you are running an old version, please do not consider to (mind as well) upgrade to the latest version without reading what it first needs to be done. The upgrade to 8.2.1 should not be much of a change.
Mike Rojas -
I have 3 iTunes libraries on my one one computer and since I updated to the new version I can no longer see who's library I am in. It used to show at the top of iTunes the name of the library I was in. Is there a way I can tell which library I am in without closing and reopening?
No. Frequently the apps take up more storage space on the iPod that the file download size.
-
How can you make your persona show on the top and bottom?
Also can you make it bigger at the top to show more of the picture?Add extra empty toolbars if you want to see more of the persona.<br />
You can create extra toolbars to get extra space via View > Toolbars > Customize<br />
You have to put something on a toolbar (drag a Space item onto it) before closing the Customize window because empty toolbars are automatically removed.<br />
See http://kb.mozillazine.org/Toolbar_customization -
My events photo albums have all been renamed with a number followed by IMPRT (deleting the date on which they were taken) Also the photo now showing on the top of each folder is taken from a different event and so is not actually in the album it is sitting on top of. This happened when I linked to itunes. Any idea how to restore it to how it looked before?
One thing that I find odd is that iTunes used to rebuild the .itl file when you deleted it. It seems as if the newer iTunes somehow broke this old capability. If you delete the .itl file it can't rebuild it- it simple treats this as if this is a fresh installation and completely ignores the fact that the .xml file has all the data in it. I think Apple needs to bring back this old "feature". Of course, the negative with that was that you lost all of the "Date Added" info along with some other stuff but at least it still kept the favorites info etc. (and I think maybe even the path although I don't believe I ever tried that because my account path has never changed until now).
One side note: I can't find where the iTunes Windows SDK is. I was hoping to try to use that to access the .itl "database" and write a utility to fix this situation. Seems like this has moved from its original location... -
Archived Deliver not showing Document FLow _RV_LIKP
Folks
I have started archiving for delivery object. I am able to successfully archive one document and can view the document in SARI and the only issue i am having is the when i open the archive document the ICON which shows "DOCUMENT FLOW" is not click able so user is not able to see the document flow to find the Sales Order/STO# it was created from.
In my customization for RV_LIKP under the setting " Archiving Control for Delivery" i have put residence time as "5" and RNO "0"
Also what is the RNO field stands for .
ThanksHi Andy,
Go through the link given below.
http://help.sap.com/saphelp_40b/helpdata/pt/b7/19752690e211d1a5510000e82deaaa/content.htm
The last line looks important.
Deliveries should be archived before sales documents and billing documents. This sequence is a result of the way the documents are linked via document flow.
Hope it helps,
Regards,
MT -
I am not able to open my 'system preferences' it shows up on top, but the window just won't open. I haven't installed anything new, I have also restarted my computer, but still encounter this problem. Help?
Reinstall Lion, Mountain Lion, or Mavericks without erasing drive
Boot to the Recovery HD:
Restart the computer and after the chime press and hold down the COMMAND and R keys until the menu screen appears. Alternatively, restart the computer and after the chime press and hold down the OPTION key until the boot manager screen appears. Select the Recovery HD and click on the downward pointing arrow button.
Repair
When the recovery menu appears select Disk Utility. After DU loads select your hard drive entry (mfgr.'s ID and drive size) from the the left side list. In the DU status area you will see an entry for the S.M.A.R.T. status of the hard drive. If it does not say "Verified" then the hard drive is failing or failed. (SMART status is not reported on external Firewire or USB drives.) If the drive is "Verified" then select your OS X volume from the list on the left (sub-entry below the drive entry,) click on the First Aid tab, then click on the Repair Disk button. If DU reports any errors that have been fixed, then re-run Repair Disk until no errors are reported. If no errors are reported then click on the Repair Permissions button. When the process is completed, then quit DU and return to the main menu.
Reinstall Lion, Mountain Lion, or Mavericks
OS X Mavericks- Reinstall OS X
OS X Mountain Lion- Reinstall OS X
OS X Lion- Reinstall Mac OS X
Note: You will need an active Internet connection. I suggest using Ethernet
if possible because it is three times faster than wireless.
Maybe you are looking for
-
How to populate null values as blank in cell
Hi All, I have an query i have data like blow qtr data 1Q-4Q 2009 4,069,379 1Q-4Q 2010 3,979,490 and i want result like below 1Q-4Q 2009 4,069,379 % Change -2% 1Q-4Q 2010 3,979,490 for % age change i have applied the previous function formula is (dat
-
Hi, I would like to know how to automatically set the cursor in a specific textbox (in the front panel) when my window is loaded. I tried with the keybinding control (home for example) so if I type home key it goes there but I want this cursor in thi
-
Should I use AxMsRdpClient6 or AxMSTSCLib.AxMsRdpClient8NotSafeForScripting
Hello, I'm trying to create windows form application that allows a user to connect to a virtual machine. I have implemented VCL http://vcl.apache.org/ and users are allowed to download the rdp file but I would like to automate it so when they click
-
When I click on the ringtone "bell" symbol, I'm sent to a page that tells me either to click on the bell (which I've already done), or to the Store menu and click on "create ringtone" -- but "create ringtone" is grayed out. What do I do??? This never
-
Email Receiver QPAC - stops receiving emails after a while
Hello, I have a workflow with the first step being an Email Receiver QPAC. Next I extract out some information to set to variables and then use the Chain QPAC to go to my next workflow and loop back to the Email Receiver (thanks Howard!). It works gr