ip cach flow question

branigan 21 years ago

The following output is from using the command above. I needed help identifying what some of the column heading are used for. I am mostly concerned about the following:

Pr SrcP are these in hex? DstP "" Pkts I believe this is packets, but what does the number identify?

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts AT1/IMA3.1 10.10.131.70 Fa0/0 212.194.216.2 06 072B 01BD

2 AT1/IMA3.1 10.55.0.138 Fa0/0 95.219.206.52 06 048A 01BD
1 AT1/IMA3.1 10.40.8.186 Fa0/0 169.250.109.5 06 0A5D 01BD
3

Thx I appreciate your help...

Vote

Anthrax 21 years ago

Hi,

from:

formatting link

Pr IP protocol well-known port number as described in RFC 1340, displayed in hexadecimal format.

Pkts

Number of packets switched through this flow.

there's no more information there for the other fields but digging more in the docs..

from:

formatting link

This list of flows is similar to the output of the show ip cache flow or show ip cache verbose flow command, but the list can be sorted and viewed according to user-configurable criteria.

ergo...

formatting link

SrcP Source port.

DstP Destination port.

if Pr is in hex common sense will be that Srcp and DstP are too. Hope it helps.

Vote

Scooby 21 years ago

Here's a good link that describes the well know ports and protocol numbers for reference...

formatting link

Yes, the protocol and port numbers are in hex. The Pkts is the number of packets that have been passed in this flow. All flows listed are active flows. There are timeouts, so flows could get purged from the list and start over. This is just basic information that you can use to see what traffic is currently passing through the router. If you get a netflow statistics collector, you will see a lot more information as well as seeing it in some logical order.

Jim

formatting link