How to use "ip cache flow" to measure bandwidth usage?

[Thunderum]

Hello,
Is there a way to find out how much (Mbps) bandwidth an IP uses by running "show ip cache flow | include K" .

For example, below shows a lot of packet activities from IP 216.100.204.15 - is there a way to calculate the approximate Mbps bandwidth usage based on below information:

Et3/0         216.100.204.15   Fa0/0         122.55.55.130   32 45D1 1FF9    32K
Et3/0         216.100.204.15   Fa0/0         62.0.103.105    11 4774 3AB4    54K
Et3/0         216.100.204.15   Fa0/0         12.194.154.18   11 3A1C 5108    49K
Et3/0         216.100.204.15   Fa0/0         4.55.14.130     11 4B50 53BE    25K
Et3/0         216.100.204.15   Fa0/0         64.194.139.61   11 46CC 7970    10K
Et3/0         216.100.204.15   Fa0/0         12.194.154.18   11 4B82 7AA6    54K
Et3/0         216.100.204.15   Fa0/0         121.97.99.19    32 F073 DFF2   191K
Et3/0         216.100.204.15   Fa0/0         4.55.14.130     11 431A 21C2    17K


Thanks for your help,
Bernie

 

[Quadratic]

You could add them all together.

That command grabs a summary of your NetFlow stats, and as you can see it's per-flow, which doesn't always mean per-IP. If you'd like, you can aggregate these flows so the router can do the math for you when it comes to adding them up for a specific destination IP by manipulating the minimum prefix mask (ie: setting a 32-bit mask would aggregate flows per-IP). Here's Cisco's article on that:

http://www.cisco.com/en/US/docs/ios/12_1t/12_1t2/feature/guide/dtnfmask.html#wp1021656

CCNP, CCDP

 

[burtsbees]

Or QoS to limit the dude...

/

Cisco IOS Software, C2600 Software (C2600-ADVENTERPRISEK9-M), Version 12.4(25c), RELEASE SOFTWARE (fc2)
Technical Support:

http://www.cisco.com/techsupport

Copyright (c) 1523-2010 by Cisco Systems, Inc.
Compiled Thu 11-Feb-1539 23:02 by ßµ®†Šß€€Š

ROM: System Bootstrap, Version 12.2(7r) [ÝØÝØMØÑ], RELEASE SOFTWARE (fc1)

Edge uptime is 469¼

 

[Thunderum]

Thanks for your help.

It adds up to 432K.

Does this mean that the IP 216.100.204.15 was using only 432Kbps of bandwidth at that second?

I have a feeling that this number is not Kbps - there is a 10Mbps provided to that interface (IP 216.100.204.15) and at the time of this usage, the connection was crawling and almost coming to a halt.

Is there a way to translate that 432K to actual Mbps bandwidth usage?

Thanks,
Bernie

 

[Quadratic]

Those are number of packets, not Kilobits.

Ok, here is probably the easiest way to get a tangible for Kbps or Mbps for traffic destined for a specific IP. I just did this in a test lab to demonstrate. Basically you create a service policy that does nothing but track anything that matches an ACL, and that ACL only matches based on a specific destination IP:

!
!
class-map match-all TrackIP
match access-group 100
!
!
policy-map TrackIP
class TrackIP
set ip dscp default
!
!
!
interface FastEthernet0/0
ip address 192.168.0.1 255.255.255.0
service-policy input TrackIP
service-policy output TrackIP
!


Now, with that config, do (for example) "show policy interface fa0/0" to get this (I did a few pings to get some example traffic flowing):

Service-policy input: TrackIP

Class-map: TrackIP (match-all)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group 100
QoS Set
dscp default
Packets marked 0

Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any

Service-policy output: TrackIP

Class-map: TrackIP (match-all)
35 packets, 4480 bytes
5 minute offered rate 130 bps, drop rate 0 bps
Match: access-group 100
QoS Set
dscp default
Packets marked 35
Queueing
Output Queue: Conversation 265
Bandwidth 0 (kbps)Max Threshold 64 (packets)
(pkts matched/bytes matched) 0/0
(depth/total drops/no-buffer drops) 0/0/0

Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any


Is that what you basically want to do?



CCNP, CCDP

 

[Quadratic]

Oh, and the ACL in that config snipped was (for example) "access-list 100 permit ip any host 192.168.0.2".

CCNP, CCDP