使用路由器作流量檢測的幾種方法(1)

2019-11-05 01:01:46

字體：大中小

來源：轉載

供稿：網友

一、ip accounting

1、配置方法

router(config)#int s 0/0

router(config-if)#ip accounting output-packets

router#sh ip accounting output-packets

Source Destination Packets Bytes

192.1.1.110 192.1.1.97 5 500

172.17.246. 128 192.1.1.110 8 704

Accounting data age is 2d23h

或者

router(config)#int s 0/0

router(config-if)#ip accounting access-violations

router#sh ip accounting [checkpoint] access-violations

Source Destination Packets Bytes ACL

192.1.1.110 224.0.0.5 46 3128 19

Accounting data age is 7

2、說明

此方法假如在路由器負載特大的時候請謹慎使用，因其會使系統性能下降；基于地址對的字節數量及數據包數量統計；通常只支持outbound的數據包，及被ACL拒絕的數據包（支持IN 和 OUT方向的ACL）；只統計穿越路由器的流量，源或目的是該路由器的數據包不做統計；支持所有的switching path，除了Autonomous Switching；可以通過SNMP來訪問統計值，MIB是OLD-CISCO-IP-MIB, lipAccountingTable；ip accounting還支持其他的監測方式，如基于tos,mac-address等。

二、netflow

1、配置方法

router (config-if)#ip route-cache flow

router (config)#ip flow-eXPort destination 172.17.246.225 9996

router (config)#ip flow-export version 5 <peer-as origin-as>

Optional configuration

router (config)#ip flow-export source loopback 0

router (config)#ip flow-cache entries <1024-524288>

router (config)#ip flow-cache timeout

sh ip cache flow

IP packet size distribution (132429191 total packets):

1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480

.000 .191 .024 .009 .010 .006 .005 .008 .003 .005 .003 .003 .002 .001 .001

512 544 576 1024 1536 2048 2560 3072 3584 4096 4608

.001 .002 .107 .032 .578 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 278544 bytes

33 active, 4063 inactive, 7975259 added

104834714 ager polls, 0 flow alloc failures

Active flows timeout in 30 minutes

Inactive flows timeout in 15 seconds

last clearing of statistics never

PRotocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)

-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow

TCP-Telnet 25378 0.0 12 652 0.0 22.9 15.2

TCP-FTP 432435 0.1 4 59 0.4 1.2 2.7

TCP-FTPD 28670 0.0 212 1397 1.4 8.2 1.6

TCP-WWW 4682530 1.0 15 927 16.4 2.4 4.6

2、說明

統計基于流（包括地址對、端口號、協議類型等）的數據量；只支持inbound的流量；只支持單播；只能在主端口配置；需要和cef或fast switching一起使用；對路由器性能有影響。

10,000 active flows: < 4% of additional CPU utilization

45,000 active flows: <12% of additional CPU utilization

65,000 active flows: <16% of additional CPU utilization

更多的請看：http://www.QQread.com/windows/2003/index.Html

二、netflow

1、配置方法

router (config-if)#ip route-cache flow

router (config)#ip flow-export destination 172.17.246.225 9996

router (config)#ip flow-export version 5 <peer-as origin-as>

Optional configuration

router (config)#ip flow-export source loopback 0

router (config)#ip flow-cache entries <1024-524288>

router (config)#ip flow-cache timeout

sh ip cache flow

IP packet size distribution (132429191 total packets):

1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480

.000 .191 .024 .009 .010 .006 .005 .008 .003 .005 .003 .003 .002 .001 .001

512 544 576 1024 1536 2048 2560 3072 3584 4096 4608

.001 .002 .107 .032 .578 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 278544 bytes

33 active, 4063 inactive, 7975259 added

104834714 ager polls, 0 flow alloc failures

Active flows timeout in 30 minutes

Inactive flows timeout in 15 seconds

last clearing of statistics never

Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)

-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow

TCP-Telnet 25378 0.0 12 652 0.0 22.9 15.2

TCP-FTP 432435 0.1 4 59 0.4 1.2 2.7

TCP-FTPD 28670 0.0 212 1397 1.4 8.2 1.6

TCP-WWW 4682530 1.0 15 927 16.4 2.4 4.6

2、說明

統計基于流（包括地址對、端口號、協議類型等）的數據量；只支持inbound的流量；只支持單播；只能在主端口配置；需要和cef或fast switching一起使用；對路由器性能有影響。

10,000 active flows: < 4% of additional CPU utilization

45,000 active flows: <12% of additional CPU utilization

65,000 active flows: <16% of additional CPU utilization