[c-nsp] Netflow Top Talkers?

[Aamer Akhter (aakhter)]

Hi Dale,

The output for Flexible NetFlow has the L4 ports in decimal format, eg:

LX-7301-10#show flow monitor nf-original-with-dstIntKey cac format table | in 102.2|TOS
INTF OUTPUT  IP TOS  IP PROT  IPV4 SRC ADDR  IPV4 DST ADDR  TRNS SRC PORT  TRNS DST PORT  INTF INPUT
Fa1/1        0x00          6  10.17.102.2    10.17.195.4             1346             80  Fa1/0     
Fa1/1        0x02          6  10.17.102.2    10.17.195.4             1346             80  Fa1/0     
Fa1/0        0x00          6  10.17.195.4    10.17.102.2               80           1346  Fa1/1 

* this is not an exact output-- some columns might be edited out. Just something I had handy.

-- 
Aamer Akhter / aa at cisco.com
Ent & Commercial Systems, cisco Systems

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Dale Shaw
> Sent: Wednesday, March 19, 2008 2:22 AM
> To: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Netflow Top Talkers?
> 
> Hi,
> 
> <..on-topic, relevant NetFlow conversations snipped..>
> 
> While we're on the topic of quick n dirty methods for seeing top
> talkers/active flows through a router (i.e. methods that don't depend
> on any supporting infrastructure), does anyone else find the "sh ip
> cache flow" output only partially useful? I'm referring to the fact
> that protocol and port numbers are listed in hex.
> 
> I'm not sad enough to have memorised for the hex values for well known
> ports yet.
> 
> Having these values displayed in decimal would make a quick glance
> possible.
> 
> Is there a nerd-knob to change the way this is displayed?
> 
> cheers,
> Dale
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/