Cisco路由器基于协议及MAC的流量分析Netflow.doc

Cisco路由器基于协议及MAC的流量分析Netflow.txt每个女孩都曾是无泪的天使，当遇到自己喜欢的男孩时，便会流泪一一，于是坠落凡间变为女孩，所以，男孩一定不要辜负女孩，因为女孩为你放弃整个天堂。朋友,别哭,今夜我如昙花绽放在最美的瞬间凋谢,你的泪水也无法挽回我的枯萎本文由 百度文库批量上传下载工具 生成Created By Yelky QQ:283830411如何对Cisco路由器进行协议及MAC流量分析，方法总结如下：端口设置netflow (基于协议)a,Enabling NetFlow Exportinterfaceinterfaceinterface_numberip route-cache flowbandwidth b, Exporting NetFlow DataIssue the following commands to export NetFlow data to the server on which NetFlow Analyzer is runningip flow-export destinationhostname|ip_address9996ip flow-export sourceinterfaceinterface_numberip flow-export version 5 peer-as | origin-assnmp-server ifindex persistc,Verifying Device Configurationshow ip flow exportshow ip cache flowshow ip cache verbose flowd,A Sample Device Configurationrouter#enablePassword:*router#configure terminalrouter-2621(config)#interface FastEthernet 0/1router-2621(config-if)#ip route-cache flowrouter-2621(config-if)#exitrouter-2621(config)#ip flow-export destination 01 9996router-2621(config)#ip flow-export source FastEthernet 0/1router-2621(config)#ip flow-export version 5router-2621(config)#ip flow-cache timeout active 1router-2621(config)#ip flow-cache timeout inactive 15router-2621(config)#snmp-server ifindex persistrouter-2621(config)#Zrouter#writerouter#show ip flow exportrouter#show ip cache flowe,Turning off NetFlowno ip flow-export destinationhostname|ip_addressport_numberno ip route-cache flow测试实例：CISCO_PPPOE#show ip cache flowIP packet size distribution (2667212 total packets):1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480.000 .342 .081 .015 .010 .002 .003 .003 .002 .002 .002 .003 .002 .003 .003512 544 576 1024 1536 2048 2560 3072 3584 4096 4608.003 .004 .006 .040 .464 .000 .000 .000 .000 .000 .000IP Flow Switching Cache, 278544 bytes33 active, 4063 inactive, 50346 added1608792 ager polls, 0 flow alloc failuresActive flows timeout in 30 minutesInactive flows timeout in 15 secondsIP Sub Flow Cache, 21640 bytes6 active, 1018 inactive, 12031 added, 12031 added to flow0 alloc failures, 0 force free1 chunk, 1 chunk addedlast clearing of statistics neverProtocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)- Flows /Sec /Flow /Pkt /Sec /Flow /FlowTCP-Telnet 9 0.0 13 59 0.0 7.0 12.2TCP-FTP 7 0.0TCP-WWW 14563 0.0 17 1145 0.1 3.4 7.1TCP-SMTP 8 0.0 11 67 0.0 3.1 10.2TCP-X 314 0.0 1 40 0.0 0.0 15.4TCP-other 6851 0.0 17 628 0.0 7.4 10.9UDP-other 27164 0.0 83 703 1.7 21.9 15.4ICMP 1398