Cisco IOS Software Releases 12.0 S

Table Of Contents

MPLS-aware NetFlow

Contents

Prerequisites for MPLS-aware NetFlow

Restrictions for MPLS-aware NetFlow

Information About MPLS-aware NetFlow

MPLS Label Stack

MPLS-aware NetFlow Capture and Display of MPLS Labels

MPLS-aware NetFlow Capture of MPLS Labels

MPLS-aware NetFlow Display of MPLS Labels

Information Captured and Exported by MPLS-aware NetFlow

Full and Sampled MPLS-aware NetFlow Support

How to Configure MPLS-aware NetFlow

Configuring MPLS-aware NetFlow on a Router

Configuring Sampling for MPLS-aware NetFlow on Cisco 7500 and 7200 Platforms

Displaying MPLS-aware NetFlow Information on a Router

Configuration Examples for MPLS-aware NetFlow

Configuring MPLS-aware NetFlow on a Router Examples

Configuring Sampling for MPLS-aware NetFlow on Cisco 7500 and 7200 Platforms Examples

Displaying MPLS-aware NetFlow Information on a Router Examples

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

ip flow-cache mpls label-positions

show ip cache verbose flow

Glossary

MPLS-aware NetFlow

---

Multiprotocol Label Switching (MPLS)-aware NetFlow is an extension of the NetFlow accounting feature that provides highly granular traffic statistics for Cisco routers. MPLS-aware NetFlow collects statistics on a per-flow basis just as NetFlow does. A flow is a unidirectional set of packets (IP or MPLS) that arrives at the router on the same subinterface, has the same source and destination IP addresses, has the same Layer 4 protocol, the same TCP/UDP source and destination ports, and the same type of service (TOS) byte in the IP header. In addition, an MPLS flow contains up to three of the same incoming MPLS labels of interest with experimental bits and end-of-stack bits in the same positions in the packet label stack. MPLS-aware NetFlow captures MPLS traffic that contains both IP and non-IP packets. It reports non-IP packets, but sets the IP NetFlow fields to 0. It can also be configured to capture and report IP packets, setting to 0 the IP NetFlow fields. MPLS-aware NetFlow uses the NetFlow Version 9 export format. MPLS-aware NetFlow exports up to three labels of interest from the incoming label stack, the IP address associated with the top label, as well as traditional NetFlow data.

A network administrator can turn on MPLS-aware NetFlow inside an MPLS cloud on a subset of provider backbone (P) routers. These routers can export MPLS-aware NetFlow data to an external NetFlow collector device for further processing and analysis or show NetFlow cache data on a router terminal. MPLS-aware NetFlow statistics can be used for detailed MPLS traffic studies and analysis.

Feature Specifications for MPLS-aware NetFlow

Feature History
Release	Modification
12.0(24)S	This feature was introduced.
12.0(25)S	The no-ip-fields and mpls-length keywords were added to the ip flow-cache mpls label-positions command.
12.0(26)S	This feature was implemented on the Cisco 7200 and 7500 platforms and integrated into Cisco IOS 12.0(26)S. Support was added for the Cisco 12000 Series 8-Port OC-3 STM ATM line cards.
12.0(26)S1	Support was added for sampled MPLS-aware NetFlow on the Cisco 7200 and 7500 platforms.
Supported Platforms
Cisco 7200 series, Cisco 7500 series, Cisco 12000 series (For specific line cards that support this feature, see Table 1.)

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Contents

•Prerequisites for MPLS-aware NetFlow

•Restrictions for MPLS-aware NetFlow

•Information About MPLS-aware NetFlow

•How to Configure MPLS-aware NetFlow

•Configuration Examples for MPLS-aware NetFlow

•Additional References

•Command Reference

•Glossary

Prerequisites for MPLS-aware NetFlow

The MPLS-aware NetFlow feature requires the following:

•NetFlow configured on the label switch router (LSR)

•MPLS enabled on the LSR

•Cisco Express Forwarding (CEF) or Distributed CEF (dCEF) enabled on the LSR

If you are exporting to a Cisco NetFlow collector, the following requirements apply:

•NetFlow Version 9 export format configured on the LSR

•NetFlow collector and analyzer capable of using MPLS-aware NetFlow export packets in Version 9 format

Table 1 lists the Cisco 12000 series line cards support for Cisco IOS S releases of MPLS-aware NetFlow.

Table 1 Cisco 12000 Series Line Cards Support for MPLS-aware NetFlow 

Type	Line Card
Ethernet	1-Port GbE1 8-Port FE1 3-Port GbE 1-Port 10-GbE Modular GbE
Packet Over Sonet (POS)	4-Port OC-3 POS2 1-Port OC-12 POS2 1-Port OC-48 POS 4-Port OC-12 POS 4-Port OC-12 POS ISE 1-Port OC-48 POS ISE 4-Port OC-3 POS ISE 8-Port OC-3 POS ISE 16-Port OC-3 POS ISE 1-Port OC-192 POS ES (Edge Release) 4-Port OC-48 POS ES (Edge Release)
Channelized Interfaces	1-Port CHOC-12 (DS3)2 1-Port CHOC-12 (OC-3)2 6-Port Ch T3 (DS1)2 2-Port CHOC-32 1-Port CHOC-48 ISE 4-Port CHOC-12 ISE
Electrical Interface	6-Port DS32 12-Port DS3 2 6-Port E32 12-Port E32
Dynamic Packet Transport	1-Port OC-12 DPT1 1-Port OC-48 DPT 4-Port OC-48 DPT 1-Port OC-192 DPT
Asynchronous Transfer Mode (ATM)	4-Port OC-3 ATM2 1-Port OC-12 ATM2 8-Port OC-3 STM-1 ATM2

1 This Cisco 12000 line card does not support MPLS-aware NetFlow. 2 This Cisco 12000 line card supports MPLS-aware NetFlow enabled in either full or sampled mode. Line cards not marked with a footnote character support MPLS-aware NetFlow in sampled mode only. In general, Cisco 12000 line cards support MPLS-aware NetFlow in the same mode as they support NetFlow.

Restrictions for MPLS-aware NetFlow

The following restrictions apply to the MPLS-aware NetFlow feature for this release:

•The maximum number of MPLS labels allowed to be captured and exported for this implementation is three.

•MPLS-aware NetFlow reports the following fields in MPLS flows as 0: IP next-hop, source and destination Border Gateway Protocol (BGP) autonomous system (AS) numbers, source and destination prefix masks.

•For MPLS packets that contain non-IP packets under the MPLS label stack, MPLS-aware NetFlow reports the following flow fields as 0: source and destination IP addresses, protocol, TOS, ports, and TCP flags.

•The IP addresses associated with the top label for traffic engineering (TE) tunnel midpoints and Any Transport over MPLS (AToM) are reported as 0.0.0.0.

•The top label type and IP address are obtained at the moment of flow export. Either can be incorrect if the top label was deleted or reassigned since the creation of the flow in the NetFlow cache.

•On the Cisco 12000 1-Port 10-GbE, Modular GbE, 1-Port OC-192 POS ES (Edge Release), and 4-Port OC-48 POS ES (Edge Release) line cards:

–MPLS-aware NetFlow samples both IP and MPLS packets, but reports only MPLS packets with one label ignoring all other packets (that is, IP and MPLS packets with more than one label).

–MPLS-aware NetFlow does not report application (TCP/UDP) port numbers.

–MPLS-aware NetFlow reports experimental bits in MPLS labels as 0.

•The Cisco 12000 1-Port OC-48 POS, 4-Port OC-12 POS, 16-Port OC-3 POS, 3-Port GbE, and the 1-Port OC-48 DPT line cards support MPLS-aware NetFlow in sampled mode in all microcode bundles that include IP-sampled NetFlow.

Information About MPLS-aware NetFlow

The following sections contain useful information for understanding how to configure and use the MPLS-aware NetFlow feature:

•MPLS Label Stack

•MPLS-aware NetFlow Capture and Display of MPLS Labels

•Information Captured and Exported by MPLS-aware NetFlow

•Full and Sampled MPLS-aware NetFlow Support

MPLS Label Stack

As packets move through an MPLS network, label switch routers (LSRs) can add labels to the MPLS label stack. LSRs in an MPLS cloud can add up to six labels to the MPLS label stack. An LSR adds the MPLS labels to the top of the IP packet. Figure 1 shows an example of an incoming MPLS label stack that LSRs might have added to an IP packet as it traversed an MPLS cloud.

Figure 1 Example of an MPLS Label Stack Added to an IP Packet in an MPLS Cloud

In the example of an MPLS label stack in Figure 1:

•The 33 represents the top label of this packet.

This label was the last label added to the MPLS label stack and the label that MPLS-aware NetFlow captures if you indicate the label of interest as 1.

•The 42 represents the second label in the MPLS stack.

MPLS-aware NetFlow captures this label if you indicate 2 (second from the top) as a label of interest.

•The 16 represents the third label in the MPLS label stack.

MPLS-aware NetFlow captures this label if you indicate 3 (third from the top) as a label of interest.

•Lb4-Lb6 represents the fourth to sixth labels in the MPLS stack. LSRs in an MPLS cloud add up to six labels to the MPLS label stack.

MPLS-aware NetFlow captures these label if you indicate 4, 5, or 6, respectively, as labels of interest.

•The B represents miscellaneous bits, as follows:

–Exp—Three bits reserved for experimental use

–S—End-of-stack bits, set to 1 for the last entry in the stack and to 0 for all other entries

–Time To Live (TTL)—Eight bits used to encode a hop count (or time to live) value

Figure 2 shows a sample carrier supporting carrier (CSC) network topology and the incoming MPLS label stack at LSRs as the packet travels through the network. Figure 2 shows what the stack might look like at a provider core LSR.

Figure 2 Provider and Customer Networks and MPLS Label Imposition

In the example in Figure 2, a hierarchical VPN is set up between two customer edge (CE) routers.

•Traffic flows from the customer router to a provider edge (PE) router, possibly an Internet service provider (ISP). Here, a VPN label (16) is imposed on the inbound IP packet.

•The ISP network eventually connects to an Internet backbone provider where a CSC label (42) is imposed on the label stack.

•As packets traverse the backbone network, an LDP label (33) is imposed on the label stack.

At the inbound interface noted in Figure 2, MPLS-aware NetFlow captures the MPLS label stack and reports that the top label (33) is an LDP label, the second label (42) is a CSC label, and the third label (16) is a VPN label.

With NetFlow and MPLS-aware NetFlow enabled on the P router, you can determine the label type for the specified labels, and the IP address associated with the top label on the incoming interface (see the "MPLS-aware NetFlow Capture of MPLS Labels" section).

MPLS-aware NetFlow Capture and Display of MPLS Labels

This section contains the following topics:

•MPLS-aware NetFlow Capture of MPLS Labels

•MPLS-aware NetFlow Display of MPLS Labels

MPLS-aware NetFlow Capture of MPLS Labels

When you configure the MPLS-aware NetFlow feature, you select the MPLS label positions in the incoming label stack that you are interested in monitoring and using as key flow fields. You can choose to capture up to three labels from positions 1 to 6 in the MPLS label stack. Label positions are counted from the top of the stack. For example, the position of the top label is 1, the position of the next label is 2, and so on. You enter the stack location value as an argument to the ip flow-cache mpls label-positions [label-position-1 [label-position-2 [label-position-3]]] command, where label-position-n represents the position of the label on the incoming label stack. For example, the ip flow-cache mpls label-positions 1 3 4 command configures MPLS-aware NetFlow to capture and export the first (top), the third, and the fourth label. If you enter this command and label stack consists of two MPLS labels, MPLS-aware NetFlow captures only the first (top) label. If some of the labels you requested are not available, they are not captured or reported.

---

Note For this implementation, MPLS-aware NetFlow allows the capture of up to three labels.

---

In addition to capturing MPLS labels from the label stack and using them as key flow fields, MPLS-aware NetFlow records the following MPLS label information as nonkey flow fields:

•Type of top label—The type can be any of the following: unknown, TE tunnel midpoint, AToM, VPN, BGP, or LDP.

•The IP address associated with the top label—The route prefix to which the label maps.

---

Note For this implementation, IP addresses for TE tunnel midpoint and AToM top labels are reported as 0.0.0.0.

---

MPLS-aware NetFlow is enabled globally on the router. However, NetFlow is enabled per interface and must be enabled in either full or sampled mode on the interfaces where you choose to capture and export MPLS and IP NetFlow data.

---

Note See Table 1 for information on Cisco 12000 Series line cards support for NetFlow full and sampled modes.

---

MPLS-aware NetFlow Display of MPLS Labels

The MPLS-aware NetFlow feature allows the display of a snapshot of the NetFlow cache, including MPLS flows, on a terminal using the show ip cache verbose flow command. For example, output like the following from a provider core router (P router) shows position, value, experimental bits, and end-of-stack bit for each MPLS label of interest. It also shows the type of the top label and the IP address associated with the top label.

SrcIf          SrcIPaddress    DstIf          DstIPaddress    Pr TOS Flgs  Pkts

Port Msk AS                    Port Msk AS    NextHop              B/Pk  Active

PO3/0          10.1.1.1        PO5/1          10.2.1.1        01 00  10       9

0100 /0  0                     0200 /0  0     0.0.0.0               100     0.0

Pos:Lbl-Exp-S 1:12305-6-0 (LDP/10.10.10.10) 2:12312-6-1

In the example from a P router:

•The value of the top label is 12305.

•The experimental bits value is 6 and the end-of-stack bit is 0.

•The label type is LDP label and the IP address associated with the label is 10.10.10.10.

•The value of the next label from the top is 12312, the experimental bits value is 6, and the end-of-stack bit is 1.

To fully understand and use the information gathered on the P router, you need information from the label forwarding information base (LFIB) on the PE router.

---

Note The meaning of label for any MPLS label except the top label is not reported by MPLS-aware NetFlow. Therefore, you need to understand your network if you are interested in identifying the meaning of label for other than the top MPLS label.

---

Using MPLS-aware NetFlow, you can monitor various labels in the MPLS label stack. You can also export this information to a NetFlow collector for further processing with a data analyzer and look at MPLS traffic patterns in your network.

Information Captured and Exported by MPLS-aware NetFlow

MPLS-aware NetFlow captures and reports on other information in addition to MPLS labels. MPLS-aware NetFlow provides per-flow statistics for both incoming IP and MPLS traffic.

•For MPLS traffic, MPLS-aware NetFlow captures and reports up to three labels of interest, type and associated IP address of the top label along with a subset of NetFlow data.

•For IP traffic, MPLS-aware NetFlow provides the regular NetFlow data.

MPLS-aware NetFlow uses Version 9 format to export both IP and MPLS NetFlow data.

MPLS-aware NetFlow provides the following traditional NetFlow per-flow statistics:

•Number of packets

•Number of bytes, counting either MPLS payload size only or MPLS payload size plus MPLS label stack size

•Time stamp of the first packet

•Time stamp of the last packet

Along with these statistics, MPLS-aware NetFlow exports the following fields for each flow, using Version 9 NetFlow export format:

•Regular NetFlow fields:

–Source IP address

–Destination IP address

–Transport layer protocol

–Source application port number

–Destination application port number

–IP Type of Service (ToS)

–TCP flags (the result of bitwise OR of TCP flags from all packets in the flow)

–Input interface

–Output interface

---

Note With the exception of the input interface and output interface fields, these regular NetFlow fields are not included in a flow if the no-ip-fields keyword is specified in the ip flow-cache mpls label-positions command.

---

•Additional fields:

–Up to three incoming MPLS labels with experimental bits and an end-of-stack bit

–Positions of the above labels in the label stack

–Type of the top label

–An address prefix associated with the top label specific to the label type:
TE-This is always set to "0.0.0.0" because tunnel label addresses are not supported.
LDP-The address prefix is the IP address of the next-hop.
VPN-If the VRFs do not have overlapping IP addresses, the address prefix is the the destination prefix. If the VRFs have overlapping IP addresses the destination prefix given may be ambiguous.

---

Note Unlike NetFlow, MPLS-aware NetFlow reports IP next-hop, source and destination BGP autonomous system numbers, or source and destination prefix masks as 0 for MPLS packets.

---

---

Note If you are exporting MPLS data to a NetFlow collector or a data analyzer, the collector must support NetFlow Version 9 flow export format, and you must configure NetFlow export in Version 9 format on the router.

---

For more information on IP NetFlow, refer to the Cisco IOS Switching Services Configuration Guide, Release 12.2, NetFlow Switching.

Full and Sampled MPLS-aware NetFlow Support

Table 2 shows MPLS-aware NetFlow full and sampled NetFlow support based on the Cisco IOS release and includes the commands to implement the functionality on a supported platform.

Table 2 MPLS-aware NetFlow Full and Sampled NetFlow Support

Cisco IOS Release	Full or Sampled NetFlow	Cisco 12000 Series— Commands to Implement	Cisco 7500/7200 Series—Commands to Implement1
12.0(24)S	Sampled	ip route-cache flow sampled	—
	Full	—	—
12.0(26)S	Sampled	ip route-cache flow sampled	flow-sampler-map sampler-map-name mode random one-of packet-interval interface type number flow-sampler sampler-map-name
	Full	—	ip route-cache flow

1 NetFlow sampling on the Cisco 7500/7200 platforms is performed by a feature called Statistical Sampling NetFlow. For more information about Statistical Sampling Netflow, see the Statistical Sampling NetFlow feature module, Cisco IOS Release 12.0(26)S

How to Configure MPLS-aware NetFlow

This section contains the following procedures for configuring MPLS-aware NetFlow:

•Configuring MPLS-aware NetFlow on a Router (required)

•Configuring Sampling for MPLS-aware NetFlow on Cisco 7500 and 7200 Platforms (optional)

•Displaying MPLS-aware NetFlow Information on a Router (optional)

Configuring MPLS-aware NetFlow on a Router

Perform this task to configure MPLS-aware NetFlow on a router.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type number

4. ip route-cache flow [sampled]

5. Repeat Steps 3 and 4 for each interface where you want to configure NetFlow accounting.

6. exit

7. ip flow-cache mpls label-positions [label-position-1 [label-position-2 [label-position-3]]] [no-ip-fields] [mpls-length]

8. exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Router(config)# interface pos 3/0	Configures an interface type and enters interface configuration mode. •The type argument indicates the type of interface to be configured. •The number argument is the port, connector, or interface card number. The numbers are assigned at the factory at the time of installation or when added to a system, and can be displayed with the show interfaces command.
Step 4	ip route-cache flow [sampled] Example: Router(config-if)# ip route-cache flow	Enables NetFlow accounting on the interface. •The sampled keyword enables sampled NetFlow mode for IP and MPLS-aware NetFlow accounting. Note For information on configuring a NetFlow sampler map required for sampling on Cisco 7500 and 7200 series routers, see the "Configuring Sampling for MPLS-aware NetFlow on Cisco 7500 and 7200 Platforms" section.
Step 5	Repeat Steps 3 and 4 for each interface where you want to configure NetFlow accounting.	-
Step 6	exit Example: Router(config-if)# exit	Exits to global configuration mode.
Step 7	ip flow-cache mpls label-positions [label-position-1 [label-position-2 [label-position-3]]] [no-ip-fields] [mpls-length] Example: Router(config)# ip flow-cache mpls label-positions 1 2 3	Enables MPLS-aware NetFlow. •The label-position-n argument identifies the position of an MPLS label of interest in the incoming label stack. Label positions are counted from the top of the stack, starting with 1. •The no-ip-fields keyword controls the capture and reporting of MPLS flow fields. If the no-ip-fields keyword is specified, the following IP-related flow fields are not included: –Source IP address –Destination IP address –Transport layer protocol –Source application port number –Destination application port number –IP type of service (ToS) –TCP flag (the result of a bitwise OR of TCP) If the no-ip-fields keyword is not specified, the IP related fields are captured and reported. •The mpls-length keyword controls the reporting of packet length. If the mpls-length keyword is specified, the reported length represents the sum of the MPLS packet payload length and the MPLS label stack length. If the mpls-length keyword is not specified, only the length of the MPLS packet payload is reported.
Step 8	exit Example: Router(config)# exit	(Optional) Exits to privileged EXEC mode.

Configuring Sampling for MPLS-aware NetFlow on Cisco 7500 and 7200 Platforms

Perform this task to configure sampling for MPLS-aware NetFlow on Cisco 7500 and 7200 series platforms.

SUMMARY STEPS

1. enable

2. configure terminal

3. flow-sampler-map sampler-map-name

4. mode random one-out-of packet-interval

5. exit

6. interface type number

7. flow-sampler sampler-map-name

8. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	flow-sampler-map sampler-map-name Example: Router(config)# flow-sampler-map mysampler	Defines a named object representing a NetFlow sampler. •The sampler-map-name argument is the name of the NetFlow sampler.
Step 4	mode random one-out-of packet-interval Example: Router(config-sampler-map)# mode random one-out-of 100	Specifies the sampling mode for the NetFlow sampler. •The random keyword specifies the random sampling mode. •The one-out-of packet-interval keyword argument combination defines the interval selected for random sampling. The packet interval is from 1 to 65535.
Step 5	exit Example: Router(config-sampler-map)# exit	Exits to global configuration mode.
Step 6	interface type number Example: Router(config)# interface FastEthernet 2/0	Configures an interface type and enters interface configuration mode. •The type argument indicates the type of interface to be configured. •The number argument is the port, connector, or interface card number. The numbers are assigned at the factory at the time of installation or when added to a system, and can be displayed with the show interfaces command.
Step 7	flow-sampler sampler-map-name Example: Router(config-if)# flow-sampler mysampler	Enables sampled NetFlow accounting on the interface. •The sampler-map-name argument is the name of the NetFlow sampler.
Step 8	end Example: Router(config-if)# end	Exits to privileged EXEC mode.

Troubleshooting Tips

Use the show-sampler sampler-map-name command to verify the configuration of NetFlow sampling, including the NetFlow sampling mode, sampling mode parameters, and number of packets sampled by the NetFlow sampler.

For more information on NetFlow export sampling, see the document Random Sampled NetFlow.

Displaying MPLS-aware NetFlow Information on a Router

Perform this task to display a snapshot of the MPLS-aware NetFlow cache on a router.

SUMMARY STEPS

1. enable

2. configure terminal

3. attach slot-number (Cisco 12000 series routers only) or if-con slot-number (Cisco 7500 series routers only)

4. show ip cache verbose flow

5. show ip cache flow

6. exit (Cisco 12000 series routers only) or if-quit (Cisco 7500 series routers only)

7. show running-config [interface type number]

8. exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	attach slot-number Example: Router# attach 3 or if-con slot-number Example: Router# if-con 3	(For Cisco 12000 series routers only) Accesses the Cisco IOS software image on a line card. •The slot-number argument is the slot number of the line card. or (For Cisco 7500 series routers only) Accesses the Cisco IOS software image on a line card. •The slot-number argument is the slot number of the Versatile Interface Processor (VIP).
Step 4	show ip cache verbose flow Example: LC-Slot3# show ip cache verbose flow or Example: Router# show ip cache verbose flow	Displays IP and MPLS flow records in the NetFlow cache. •Use the show ip cache verbose flow command to display MPLS-aware NetFlow cache data. Note For Cisco 7200 series routers, you enter show commands on the router, not on a line card.
Step 5	show ip cache flow Example: LC-Slot3# show ip cache flow or Example: Router# show ip cache flow	Displays a summary of the IP and MPLS flow records in the NetFlow cache. •Use the show ip cache flow command to display only the IP flow records of the MPLS flow.
Step 6	exit Example: LC-Slot3# exit or if-quit Example: LC-Slot3# if-quit	(For Cisco 12000 and Cisco 7500 routers only, respectively) Exits from the line card to privileged EXEC mode.
Step 7	show running-config [interface type number] Example: Router# show running-config interface pos 3/0	Displays the contents of the currently running configuration file. •Use the show running-config command to verify that MPLS-aware NetFlow is enabled on the specified router interface.
Step 8	exit Example: Router# exit	(Optional) Exits to user EXEC mode.

Configuration Examples for MPLS-aware NetFlow

This section contains the following configuration examples for MPLS-aware NetFlow:

•Configuring MPLS-aware NetFlow on a Router Examples

•Configuring Sampling for MPLS-aware NetFlow on Cisco 7500 and 7200 Platforms Examples

•Displaying MPLS-aware NetFlow Information on a Router Examples

Configuring MPLS-aware NetFlow on a Router Examples

The following example shows MPLS-aware NetFlow configured globally and NetFlow enabled on an interface on a Cisco 12000 series P router:

configure terminal 

ip flow-export version 9 origin-as

ip flow-sampling-mode packet-interval 101

ip flow-cache mpls label-positions 1 2 3

...

interface pos 3/0

 ip route-cache flow sampled

 end 

The following examples show MPLS-aware NetFlow configured globally and NetFlow enabled on an interface on a Cisco 7200 or 7500 series P router:

configure terminal 

ip flow-export version 9 origin-as

ip flow-sampling-mode packet-interval 101

ip flow-cache mpls label-positions 1 2 3

...

interface pos 3/0

 ip route-cache flow

 end 

To export MPLS-aware NetFlow data from the router, you need to configure NetFlow Version 9. This example shows the configuration of NetFlow Version 9 options for MPLS-aware NetFlow and IP NetFlow data export along with an explanation of what each command configures:

configure terminal  ip flow-export version 9 origin-as	Enters global configuration mode and requests v9 flow export, reports origin-as for IP packets.
ip flow-export template options sampling	Specifies the template option sampling configuration.
ip flow-export template options export-stats	Reports the number of export packets sent and the number of flows exported.
ip flow-export template options timeout 5	Exports template options every 5 minutes.
ip flow-export template timeout 5	Resends templates to the collector every 5 minutes.
ip flow-export destination 10.21.32.25 9996	Specifies export destination and UDP port.
ip flow-export source Loopback0	Specifies export source.
ip flow-sampling-mode packet-interval 101	Configures the sampling mode packet interval.
ip flow-cache mpls label-positions 1 2 3	Configures MPLS-aware NetFlow to report the top 3 labels.
interface pos 3/0  ip route-cache flow [sampled]  end	Enables full or sampled IP and MPLS-aware NetFlow on interface POS 3/0 and returns to privileged EXEC mode. Note Sampled IP and MPLS-aware NetFlow is supported on the Cisco 1200 series router only.

Configuring Sampling for MPLS-aware NetFlow on Cisco 7500 and 7200 Platforms Examples

The following examples show how to define a Netflow sampler that randomly selects one out of 100 packets for NetFlow processing, how to apply this sampler to an interface, and how to verify the sampler parameters on a Cisco 7500 or 7200 series router.

Defining the NetFlow Sampler

The following example shows how to define a NetFlow sampler called mysampler that randomly selects one out of 100 packets for NetFlow processing:

Router(config)# flow-sampler-map mysampler

Router(config-sampler-map)# mode random one-out-of 100

Applying the NetFlow Sampler to an Interface

The following example shows how to apply the NetFlow sampler named mysampler to an interface:

Router# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# interface FastEthernet 2/0

Router(config-if)# flow-sampler mysampler

Verifying the NetFlow Sampler Configuration

The show flow-sampler [sampler-map-name] command displays the following information about a NetFlow sampler: sampling mode, sampling parameters (such as packet sampling interval), and number of packets selected by the sampler for NetFlow processing.

Router> show flow-sampler mysampler

Sampler : mysampler, id : 1, packets matched : 10, mode : random sampling mode

  sampling interval is : 100

The following command displays information for all Netflow samplers configured on the router:

Router> show flow-sampler

Sampler : mysampler, id : 1, packets matched : 10, mode : random sampling mode

  sampling interval is : 100

 Sampler : mysampler1, id : 2, packets matched : 5, mode : random sampling mode 

  sampling interval is : 200

Displaying MPLS-aware NetFlow Information on a Router Examples

The following output of the show ip cache verbose flow command displays both IP and MPLS portions of flow records in a snapshot of the NetFlow cache:

For the Cisco 12000 series router:

Router# attach 3

LC-Slot3# show ip cache verbose flow

For the Cisco 7500 series routers:

Router# if-con 3

LC-Slot3# show ip cache verbose flow

For the Cisco 7200 series routers:

Router# show ip cache verbose flow

  ...             

SrcIf          SrcIPaddress    DstIf          DstIPaddress    Pr TOS Flgs  Pkts

Port Msk AS                    Port Msk AS    NextHop              B/Pk  Active

PO3/0          10.1.1.1        PO5/1          10.2.1.1        01 00  10       9

0100 /0  0                     0200 /0  0     0.0.0.0               100     0.0

Pos:Lbl-Exp-S 1:12305-6-0 (LDP/10.10.10.10) 2:12312-6-1

In this example, the value of the top label is 12305, the experimental bits value is 6, and the end-of-stack bit is 0. It is an LDP label and has an associated IP address of 10.10.10.10. The value of the next from the top label is 12312, the experimental bits value is 6, and the end-of-stack bit is 1. The 1 indicates that this is the last MPLS label in the stack.

The following output of the show ip cache flow command displays the IP portion of the MPLS flow record in the NetFlow cache:

For the Cisco 12000 series router:

Router# attach 3

LC-Slot3# show ip cache flow

For the Cisco 7500 series routers:

Router# if-con 3

LC-Slot3# show ip cache flow

For the Cisco 7200 series routers:

Router# show ip cache verbose flow

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts

PO3/0         10.1.1.1        PO5/1         10.2.1.1        01 0100 0200     9

Additional References

The following sections provide references related to MPLS-aware NetFlow:

•Related Documents

•Standards

•MIBs

•RFCs

•Technical Assistance

Related Documents

Related Topic	Document Title
NetFlow switching description and configuration tasks	"NetFlow Switching" chapter in the Cisco IOS Switching Services Configuration Guide, Release 12.2
Cisco Network Data Analyzer functions, features, and uses	Network Data Analyzer Installation and User Guide, Release 3.6
NetFlow concepts and features, guidelines for exporting NetFlow accounting statistics to a NetFlow FlowCollector (NFC) and to the Network Data Analyzer (NDA), high-level examples showing how to deploy these features in different network environments	NetFlow Services Solutions Guide
NetFlow v9 export format description and configuration tasks	NetFlow v9 Export Format
NetFlow Version 9 flow record format white paper	Cisco IOS NetFlow Version 9 Flow-Record Format
Random NetFlow sampling description and configuration tasks	Random Sampled NetFlow

Standards

Standards	Title
The IETF working group, IP Flow Information Export (ipfix), is developing a standard that this feature will support.	—

MIBs

MIBs	MIBs Link
No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.	To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs

RFCs

RFCs	Title
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.	—

Technical Assistance

Description	Link
Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.	http://www.cisco.com/public/support/tac/home.shtml

Command Reference

This section documents modified commands. All other commands used with this feature are documented in the Cisco IOS Release 12.0 command reference publications.

•ip flow-cache mpls label-positions

•show ip cache verbose flow

ip flow-cache mpls label-positions

To enable Multiprotocol Label Switching (MPLS)-aware NetFlow, use the ip flow-cache mpls label-positions command in global configuration mode. To disable MPLS-aware NetFlow, use the no form of this command.

ip flow-cache mpls label-positions [label-position-1 [label-position-2 [label-position-3]]] [no-ip-fields] [mpls-length]

no ip flow-cache mpls label-positions [label-position-1 [label-position-2 [label-position-3]]] [no-ip-fields] [mpls-length]

Syntax Description

label-position-n	Position of an MPLS label in the incoming label stack. Label positions are counted from the top of the stack, starting with 1.
no-ip-fields	Controls the capture and reporting of MPLS flow fields. If the no-ip-fields keyword is not specified, the following IP related flow fields are included: •Source IP address •Destination IP address •Transport layer protocol •Source application port number •Destination application port number •IP type of service (ToS) •TCP flag (the result of a bitwise OR of TCP) If the no-ip-fields keyword is specified, the IP related fields are not captured and reported.
mpls-length	Controls the reporting of packet length. If the mpls-length keyword is specified, the reported length represents the sum of MPLS packet payload length and the MPLS label stack length. If the mpls-length keyword is not specified, only the length of the MPLS packet payload is reported.

Defaults

MPLS-aware NetFlow is not enabled.

Command Modes

Global configuration

Command History

Release	Modification
12.0(24)S	This command was introduced.
12.0(25)S	The no-ip-fields and mpls-length keywords were added to the command.

Usage Guidelines

Use this command to configure the MPLS-aware NetFlow feature on a label switch router (LSR) and to specify labels of interest in the incoming label stack. Label positions are counted from the top of the stack, starting with 1. The position of the top label is 1, the position of the second label is 2, and so forth.

With MPLS-aware NetFlow enabled on the router, NetFlow collects data for incoming IP as well as for incoming MPLS packets on all interfaces where NetFlow is enabled in full or in sampled mode. MPLS-aware NetFlow is enabled in global configuration mode. NetFlow is enabled per interface.

Examples

The following example shows how to configure MPLS-aware NetFlow to capture the first (top), third, and fifth label:

Router(config)# ip flow-cache mpls label-positions 1 3 5

The following example shows how to configure MPLS-aware NetFlow to capture only MPLS flow information (no IP-related flow fields) and the length that represents the sum of the MPLS packet payload length and the MPLS label stack length:

Router(config)# ip flow-cache mpls label-positions no-ip-fields mpls-length

Related Commands

Command	Description
ip route-cache flow	Enables NetFlow data collection on the interface.
show ip cache flow	Displays a summary of the NetFlow switching statistics.
show ip cache verbose flow	Displays IP and MPLS flow record data in the NetFlow cache.

show ip cache verbose flow

To display IP and Multiprotocol Label Switching (MPLS) flow record data in the NetFlow cache, use the show ip cache verbose flow command in privileged EXEC mode.

show ip cache verbose flow

Syntax Description

This command has no keywords or arguments.

Command Modes

Privileged EXEC

Command History

Release	Modification
10.0	This command was introduced.
12.0(24)S	MPLS flow records were added to the command output.

Usage Guidelines

Use the show ip cache verbose flow command to display both IP and MPLS portions of MPLS flows in the NetFlow cache on a router line card. To display only the IP portion of the flow record in the NetFlow cache, use the show ip cache flow command.

Examples

The following example shows the output for both IP and MPLS portions of the flow record in the NetFlow cache:

For the Cisco 12000 series router:

Router# attach 3

LC-Slot3# show ip cache verbose flow

For the Cisco 7500 series routers:

Router# if-con 3

LC-Slot3# show ip cache verbose flow

For the Cisco 7200 series routers:

Router# show ip cache verbose flow

...             

SrcIf          SrcIPaddress    DstIf          DstIPaddress    Pr TOS Flgs  Pkts

Port Msk AS                    Port Msk AS    NextHop              B/Pk  Active

PO3/0          10.1.1.1        PO5/1          10.2.1.1        01 00  10       9

0100 /0  0                     0200 /0  0     0.0.0.0               100     0.0

Pos:Lbl-Exp-S 1:12305-6-0 (LDP/10.10.10.10) 2:12312-6-1

Table 3 describes the significant fields shown in the display.

Table 3 show ip cache verbose flow Field Descriptions 

Field	Description
SrcIf	Interface on which the packet was received.
Port Msk AS	Source Border Gateway Protocol (BGP) autonomous system. This is always set to 0 in MPLS flows.
SrcIPaddress	IP address of the device which transmitted the packet.
DstIf	Interface from which the packet was transmitted.
Port Msk AS	Destination BGP autonomous system. This is always set to 0 in MPLS flows.
DstIPaddress	IP address of the destination device.
NextHop	Specifies the BGP next hop address. This is always set to 0 in MPLS flows.
Pr	IP protocol well-known port number as described in RFC 1340, displayed in hexadecimal format.
B/Pk	Average number of bytes observed for the packets seen for this protocol (total bytes for this protocol or the total number of flows for this protocol for this summary period).
TOS	Type of service.
Flgs	TCP flags (result of bitwise OR of TCP flags from all packets in the flow).
Active	Number of active flows in the NetFlow cache at the time this command was entered.
Pkts	Number of packets switched through this flow.
Pos	Position of the MPLS label in the label stack starting with 1 as the top label.
Lbl	Value given to the MPLS label by the router.
Exp	Value of experimental bit.
S	Value of the end-of-stack bit: Set to 1 for the oldest entry in the stack and to zero for all other entries.
LDP/10.10.10.10	Type and associated IP address for the top label in the MPLS label stack.

Related Commands

Command	Description
ip flow-cache mpls label-positions	Enables MPLS-aware NetFlow.
ip route-cache flow	Enables NetFlow data collection on the interface.
show ip cache flow	Displays a summary of the NetFlow switching statistics.

Glossary

AToM—Any Transport over MPLS. A protocol that provides a common framework to encapsulate and transport supported Layer 2 traffic types over an MPLS network core.

BGP—Border Gateway Protocol. An interdomain routing protocol that replaces EGP. BGP exchanges reachability information with other BGP systems. It is defined by RFC 1163.

CE router—customer edge router. A router that is part of a customer network and that interfaces to a provider edge (PE) router. CE routers are not aware of associated VPNs.

core router—In a packet-switched star topology, a router that is part of the backbone and that serves as the single pipe through which all traffic from peripheral networks must pass on its way to other peripheral networks.

CSC network—carrier supporting carrier network. A network topology where one service provider allows another service provider to use a segment of its backbone network. The service provider that provides the segment of the backbone network to the other provider is called the backbone carrier. The service provider that uses the segment of the backbone network is called the customer carrier.

EGP—Exterior Gateway Protocol. Internet protocol for exchanging routing information between autonomous systems. It is documented in RFC 904. This term is not to be confused with the general term exterior gateway protocol. EGP is an obsolete protocol that was replaced by BGP.

export packet—A packet from a device (for example, a router) with NetFlow Services enabled that is addressed to another device (for example, a NetFlow collector). This other device processes the packet (parses, aggregates, and stores information on IP flows).

FEC—Forward Equivalency Class. A set of packets that can be handled equivalently for the purpose of forwarding and thus is suitable for binding to a single label. The set of packets destined for an address prefix is one example of an FEC. A flow is another example.

flow—A stream of data traveling between two endpoints across a network (for example, from one LAN station to another). Multiple flows can be transmitted on a single circuit. Packets with the same value for source address, source port, destination address, and destination port might be considered a flow.

flowset—A generic term for a collection of records that follow the packet header in an export packet. The flowset contains information that must be parsed and interpreted by the collector device. There are two types of flowsets: template and data. An export packet contains one or more flowsets, and both template and data flowsets can be mixed within the same export packet.

IPv6—IP version 6. Replacement for the current version of IP (version 4). IPv6 includes support for flow ID in the packet header, which can be used to identify flows. Formerly called IPng (next generation).

label—A short, fixed-length identifier that tells switching nodes how the data (packets or cells) should be forwarded.

label imposition—The act of putting the first label on a packet.

LDP—label distribution protocol. A standard protocol between MPLS-enabled routers to negotiate the labels (addresses) used to forward packets. The Cisco proprietary version of this protocol is the Tag Distribution Protocol (TDP).

LFIB—label forwarding information base. A data structure and way of managing forwarding in which destinations and incoming labels are associated with outgoing interfaces and labels.

LSR—label switch router. A router that forwards packets in an MPLS network by looking only at the fixed-length label.

MPLS—Multiprotocol Label Switching. A switching method that forwards IP traffic using a label. This label instructs the routers and the switches in the network where to forward the packets based on preestablished IP routing information.

MPLS flow—A unidirectional sequence of MPLS packets that arrives to a router on the same subinterface, has the same source and destination IP addresses, the same Layer 4 protocol, the same TCP/UDP source and destination ports, and the same type of service (TOS) byte in the IP header. A TCP session is an example of a flow.

options template—A special type of template record used to communicate the format of data related to the NetFlow process.

packet header—The first part of an export packet that provides basic information about the packet, such as the NetFlow version, number of records contained within the packet, and sequence numbering, so that lost packets can be detected.

PE router—provider edge router. A router that is part of a service provider's network connected to a customer edge (CE) router. All VPN processing occurs in the PE router.

P router—provider core or backbone router. A router that is part of a service provider's core or backbone network and is connected to the provider edge (PE) routers.

TDP—Tag Distribution Protocol. The Cisco proprietary version of the protocol (label distribution protocol) between MPLS-enabled routers to negotiate the labels (addresses) used to forward packets.

TE—traffic engineering. Techniques and processes that cause routed traffic to travel through the network on a path other than the one that would have been chosen if standard routing methods were used.

TE tunnel—traffic engineering tunnel. A label-switched tunnel that is used for traffic engineering. Such a tunnel is set up through means other than normal Layer 3 routing; it is used to direct traffic over a path different from the one that Layer 3 routing could cause the tunnel to take.

VPN—Virtual Private Network. A secure IP-based network that shares resources on one or more physical networks. A VPN contains geographically dispersed sites that can communicate securely over a shared backbone.

---

Note Refer to the Internetworking Terms and Acronyms for terms not included in this glossary.

---

Copyright © 2003 Cisco Systems, Inc. All rights reserved.