查看mac流量(netflow)

以下单纯引用，因为奥运保障，所以未做实验，等10月份做实验再体会一下。

 

打开IP accounting和MAC accounting：

MyRouter(config)#int e1
MyRouter(config-if)#ip accounting mac-address input

MyRouter#sh int e1 mac-accounting
Ethernet1
Input (506 free)
0010.XXXX.XXXX(7 ): 3 packets, 201 bytes, last: 45540ms ago
.....
Total: 2199 packets, 252371 bytes

 

同时也可

打开NetFlow

 

RouterA(config)#int f0/1
RouterA(config-if)#ip route-cache flow


RouterA#sh ip cache flow
IP packet size distribution (334 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.000 .224 .520 .000 .000 .000 .158 .092 .000 .002 .000 .000 .000 .000 .000

512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 278544 bytes
2 active, 4094 inactive, 79 added
1563 ager polls, 0 flow alloc failures
Active flows timeout in 30 minutes
Inactive flows timeout in 15 seconds
last clearing of statistics never
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow
TCP-Telnet 3 0.0 19 42 0.0 2.1 6.1
UDP-other 73 0.0 3 122 0.0 4.6 15.5
ICMP 1 0.0 4 60 0.0 3.0 15.1
Total: 77 0.0 4 107 0.0 4.5 15.1

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
Et0 10.0.0.32 Null 10.0.0.255 11 008A 008A 1
Et0 10.0.0.32 Local 10.0.0.1 06 0768 0017 14

当然最好用ip flow-export ip-address命令把NetFlow cache中的内容导出到一个网管系统中以做二次分析。

另外注意打开NetFlow对机器性能的影响：
Note NetFlow does consume additional memory and CPU resources compared to other switching modes; therefore, it is important to understand the resources required on your router before enabling NetFlow.