Configuring IPv4 Multicast Statistics Support for Flexible NetFlow

Last Updated: November 7, 2011

This document contains information about and instructions for configuring the Cisco IOS Flexible NetFlow--IPv4 Multicast Statistics Support feature. Prior to the introduction of the Flexible NetFlow--IPv4 Multicast Statistics Support feature, Flexible NetFlow could analyze IPv4 multicast traffic, but could not report the number of replicated bytes or the number of replicated packets in multicast flows. The Flexible NetFlow--IPv4 Multicast Statistics Support feature adds the capability of reporting the number of replicated bytes and the number of replicated packets in multicast flows to Flexible NetFlow.

NetFlow is a Cisco IOS technology that provides statistics on packets flowing through a networking device. NetFlow is the standard for acquiring IP operational data from IP networks. NetFlow provides provides data to support network and security monitoring, network planning, traffic analysis, and IP accounting.

Flexible NetFlow improves on original NetFlow by adding the capability to customize the traffic analysis parameters for your specific requirements. Flexible NetFlow facilitates the creation of more complex configurations for traffic analysis and data export through the use of reusable configuration components.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Prerequisites for Configuring IPv4 Multicast Statistics Support

  • You are familiar with the information in the " Cisco IOS Flexible NetFlow Overview " module.
  • You are familiar with the information in the " Customizing Cisco IOS Flexible NetFlow Flow Records and Flow Monitors " module.
  • The networking device is running a Cisco IOS release that supports the Flexible NetFlow--IPv4 Multicast Statistics Support feature.
  • The networking device is configured for IPv4 unicast routing and IPv4 multicast routing.
  • One of the following is enabled on your networking device and on any interfaces on which you want to enable Flexible NetFlow: Cisco Express Forwarding, distributed Cisco Express Forwarding.

Restrictions for Configuring IPv4 Multicast Statistics Support

IPv4 Traffic

  • When the replication-factor field is used in a flow record, it will only have a nonzero value in the cache for ingress multicast traffic that is forwarded by the router. If the flow record is used with a flow monitor in output (egress) mode and to monitor unicast traffic, the cache data for the replication factor field is set to 0.

IPv6 Traffic

  • Traffic monitoring for multicast statistics is not supported.

Cisco IOS Release 12.2(50)SY

  • Multicast replication factor is not supported.

Information About IPv4 Multicast Statistics Support

Replicated Bytes and Packets Reporting

The Flexible NetFlow--IPv4 Multicast Statistics Support feature adds the capability of reporting the number of replicated bytes and the number of replicated packets in multicast flows to Flexible NetFlow. You can capture the packet-replication factor for a specific flow and for each outgoing stream.

You can use the The Flexible NetFlow--IPv4 Multicast Statistics Support feature to identify and count multicast packets on the ingress side or the egress side (or both sides) of a networking device. Multicast ingress accounting provides information about the source and how many times the traffic was replicated. Multicast egress accounting monitors the destination of the traffic flow.

How to Configure IPv4 Multicast Statistics Support

Configuring IPv4 Multicast Statistics Support

This task explains the steps that are used to configure multicast statistics support for IPv4 traffic.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    flow record flow-record-name

4.    description description

5.    match routing is-multicast

6.    Add key fields for the record as required using other match commands.

7.    collect counter {bytes replicated [long] | packets replicated [long]}

8.    collect routing multicast replication-factor

9.    Add nonkey fields for the record as required using other collect commands.

10.    exit

11.    flow monitor monitor-name

12.    description description

13.    record record-name

14.    exit

15.    interface type number

16.    ip flow monitor monitor-name [multicast | unicast] {input | output}

17.    Repeat Steps 15 and 16 to activate a flow monitor on any other interfaces in the networking device over which you want to monitor traffic.

18.    end

19.    show flow monitor [[name] monitor-name [cache [format {csv | record | table}]][statistics]]


DETAILED STEPS
  Command or Action Purpose
Step 1
enable


Example:

Router> enable

 

Enables privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2
configure terminal


Example:

Router# configure terminal

 

Enters global configuration mode.

 
Step 3
flow record flow-record-name


Example:

Router(config)# flow record FLOW-RECORD-2

 

Creates a flow record and enters Flexible NetFlow flow record configuration mode.

  • This command also allows you to modify an existing flow record.
 
Step 4
description description


Example:

Router(config-flow-record)# description Used for IPv4 multicast traffic analysis

 

(Optional) Creates a description for the flow record.

 
Step 5
match routing is-multicast


Example:

Router(config-flow-record)# match routing is-multicast

 

Configures IPv4 multicast destination addresses (indicating that the IPv4 traffic is multicast traffic) as a key field for the flow record.

 
Step 6
Add key fields for the record as required using other match commands.  

For information about the other match commands that are available to configure key fields, refer to the Cisco IOS Flexible NetFlow Command Reference.

 
Step 7
collect counter {bytes replicated [long] | packets replicated [long]}


Example:

Router(config-flow-record)# collect counter packets replicated

 

Configures the number of bytes or packets multiplied by the multicast replication factor (number of interfaces the multicast traffic is forwarded over) as a nonkey field.

  • Default: Uses a 32-bit counter. The long keyword configures a 64-bit counter.
 
Step 8
collect routing multicast replication-factor


Example:

Router(config-flow-record)# collect routing multicast replication-factor

 

Configures the multicast replication factor (number of interfaces over which multicast traffic is forwarded) as a nonkey field.

 
Step 9
Add nonkey fields for the record as required using other collect commands.  

For information about the other collect commands that are available to configure nonkey fields, refer to the Cisco IOS Flexible NetFlow Command Reference.

 
Step 10
exit


Example:

Router(config-flow-record)# exit

 

Exits Flexible NetFlow flow record configuration mode and returns to global configuration mode.

 
Step 11
flow monitor monitor-name


Example:

Router(config)# flow monitor FLOW-MONITOR-2

 

Creates a flow monitor and enters Flexible NetFlow flow monitor configuration mode.

  • This command also allows you to modify an existing flow monitor.
 
Step 12
description description


Example:

Router(config-flow-monitor)# description Used for IPv4 multicast traffic analysis

 

(Optional) Creates a description for the flow monitor.

 
Step 13
record record-name


Example:

Router(config-flow-monitor)# record FLOW-RECORD-2

 

Specifies the record for the flow monitor.

 
Step 14
exit


Example:

Router(config-flow-record)# exit

 

Exits Flexible NetFlow flow monitor configuration mode and returns to global configuration mode.

 
Step 15
interface type number


Example:

Router(config)# interface ethernet 0/0

 

Specifies an interface and enters interface configuration mode.

 
Step 16
ip flow monitor monitor-name [multicast | unicast] {input | output}


Example:

Router(config-if)# ip flow monitor FLOW-MONITOR-2 input

 

Activates the flow monitor that was created previously by assigning it to the interface to analyze traffic.

  • To monitor only multicast traffic, use the multicast keyword.
  • Default: Unicast traffic and multicast traffic are monitored.
 
Step 17
Repeat Steps 15 and 16 to activate a flow monitor on any other interfaces in the networking device over which you want to monitor traffic.  

--

 
Step 18
end


Example:

Router(config-if)# end

 

Exits interface configuration mode and returns to privileged EXEC mode.

 
Step 19
show flow monitor [[name] monitor-name [cache [format {csv | record | table}]][statistics]]


Example:

Router# show flow monitor FLOW-MONITOR-2 cache

 

(Optional) Displays the status and statistics for a Flexible NetFlow flow monitor.

 

Examples

The following output from the show flow monitor command shows four multicast flows and three unicast flows: 

Router# show flow monitor FLOW-MONITOR-2 cache
 
Cache type:                            Normal
  Cache size:                              4096
  Current entries:                            8
  High Watermark:                             8
  Flows added:                             4074
  Flows aged:                              4066
    - Active timeout   (  1800 secs)         46
    - Inactive timeout (    15 secs)       4020
    - Event aged                              0
    - Watermark aged                          0
    - Emergency aged                          0
IP IS MULTICAST  IPV4 DST ADDR      pkts rep
===============  ===============  ==========
Yes              224.192.16.1          16642
Yes              224.192.65.1          16621
No               10.1.4.2                  0
No               10.1.2.2                  0
No               10.1.3.2                  0
Yes              224.0.0.13                0
No               255.255.255.255           0
Yes              224.0.0.1                 0

Configuration Examples for IPv4 Multicast Statistics Support

Example Configuring IPv4 Multicast Statistics Support

This example shows how to configure the following:

  • IPv4 multicast destination addresses (indicating that the IPv4 traffic is multicast traffic) as a key field.
  • The destination IPv4 address as a key field.
  • The replicated packet count as a nonkey field.
  • The replication factor as a nonkey field.
  • The flow monitor in order to monitor only multicast traffic.

This sample starts in global configuration mode: 

!
flow record FLOW-RECORD-2
 match routing is-multicast
 match ipv4 destination address
 collect counter packets replicated
 collect routing multicast replication-factor
 exit
!
flow monitor FLOW-MONITOR-2
 record FLOW-RECORD-2
 exit
!
interface Ethernet 0/0
 no shut
 ip address 10.1.1.2 255.255.255.0
 ip flow monitor FLOW-MONITOR-2 multicast input
!
end

Where to Go Next

If you want to configure data export for Flexible NetFlow, refer to the "Configuring Data Export for Cisco IOS Flexible NetFlow with Flow Exporters" module.

If you want to configure flow sampling to reduce the CPU overhead of analyzing traffic, refer to the "Using Cisco IOS Flexible NetFlow Flow Sampling to Reduce the CPU Overhead of Analyzing Traffic" module.

If you want to configure any of the predefined records for Flexible NetFlow, refer to the "Configuring Cisco IOS Flexible NetFlow with Predefined Records" module.

Additional References

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

Overview of Flexible NetFlow

"Cisco IOS Flexible NetFlow Overview"

Emulating original NetFlow with Flexible NetFlow

"Getting Started with Configuring Cisco IOS Flexible NetFlow"

Configuring flow exporters to export Flexible NetFlow data

"Configuring Data Export for Cisco IOS Flexible NetFlow with Flow Exporters"

Configuring flow sampling to reduce the overhead of monitoring traffic with Flexible NetFlow

"Using Cisco IOS Flexible NetFlow Flow Sampling to Reduce the CPU Overhead of Analyzing Traffic"

Configuring Flexible NetFlow using predefined records

"Configuring Cisco IOS Flexible NetFlow with Predefined Records"

Using Flexible NetFlow Top N Talkers to analyze network traffic

"Using Cisco IOS Flexible NetFlow Top N Talkers to Analyze Network Traffic"

Configuration commands for Flexible NetFlow

Cisco IOS Flexible NetFlow Command Reference

Standards

Standard

Title

None

--

MIBs

MIB

MIBs Link

None

To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

RFC

Title

RFC 3954

Cisco Systems NetFlow Services Export Version 9

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for IPv4 Multicast Statistics Support

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Table 1 Feature Information for Flexible NetFlow --IPv4 Multicast Statistics Support

Feature Name

Releases

Feature Information

Flexible NetFlow

12.2(33)SRC

12.2(50)SY

12.4(9)T

15.0(1)SY

Flexible NetFlow is introduced.

Support for this feature was added for Cisco 7200 series routers in Cisco IOS Release 12.2(33)SRC.

The following commands were introduced or modified: cache (Flexible NetFlow), clear flow exporter, clear flow monitor, clear sampler, collect counter, collect flow, collect interface, collect ipv4, collect ipv4 destination, collect ipv4 fragmentation, collect ipv4 section, collect ipv4 source, collect ipv4 total-length, collect ipv4 ttl, collect routing, collect timestamp sys-uptime, collect transport, collect transport icmp ipv4, collect transport tcp, collect transport udp, debug flow exporter, debug flow monitor, debug flow record, debug sampler, description (Flexible NetFlow), destination, dscp (Flexible NetFlow), exporter, flow exporter, flow monitor, flow platform, flow record, ip flow monitor, match flow, match interface (Flexible NetFlow), match ipv4, match ipv4 destination, match ipv4 fragmentation, match ipv4 section, match ipv4 source, match ipv4 total-length, match ipv4 ttl, match routing, match transport, match transport icmp ipv4, match transport tcp, match transport udp, mode (Flexible NetFlow), option (Flexible NetFlow), record, sampler, show flow exporter, show flow interface, show flow monitor, show flow record, show sampler, source (Flexible NetFlow), statistics packet, template data timeout, transport (Flexible NetFlow).

Flexible NetFlow--IPv4 Multicast Statistics Support

12.2(33)SRE

12.2(50)SY

12.4(22)T

15.0(1)SY

The Flexible NetFlow--IPv4 Multicast Statistics Support feature adds the capability of reporting the number of replicated bytes and the number of replicated packets in multicast flows to Flexible NetFlow.

Support for this feature was added for Cisco 7200 and 7300 Network Processing Engine (NPE) series routers in Cisco IOS Release 12.2(33)SRE.

The following commands were introduced or modified: collect counter, collect routing is-multicast, collect routing multicast replication-factor, match routing is-multicast, match routing multicast replication-factor, ip flow monitor, ipv6 flow monitor.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2011 Cisco Systems, Inc. All rights reserved.