Monitoring Suspicious Flow Information

Purpose

Display information about suspicious flows. You can specify the following keywords:

delta—Displays statistics for the current baseline
brief—Displays only suspicious information
slot—Displays information for the specific slot

Action

To display information about suspicious flows:

host1(config)#show suspicious-control-flow-detection info slot 2
Suspicious Flow Detection System Information
        Suspicious Flow Detection System is enabled
 
        Using Groups
 
The suspicious control flow system is not in overflow state or using groups
Protocol Information
Protocol                                State      Transitions 
--------------------------------------- ---------- -----------
Ppp Echo Request                        OK         0
Ppp Echo Reply                          OK         0
Ppp Echo Reply Fastpath                 OK         0
Ppp Control                             OK         0
Atm Control (ILMI)                      OK         0
Atm OAM                                 OK         0
Atm Dynamic Interface Column Creation   OK         0
Atm Inverse ARP                         OK         0
Frame Relay LMI Control                 OK         0
Frame Relay Inverse Arp                 OK         0
Pppoe Control                           OK         0
Pppoe Config Dynamic Interface Column   OK         0
 Creation
Ethernet ARP Miss                       OK         0
Ethernet ARP                            OK         0
Ethernet LACP packet                    OK         0
Ethernet Dynamic Interface Column       OK         0
 Creation
Slep SLARP                              OK         0
MPLS TTL Exceeded On Receive            OK         0
MPLS TTL Exceeded On Transmit           OK         0
MPLS MTU Exceeded                       OK         0
Ipsec Transport Mode L2tp Control       OK         0
NAT/Firewall Payload                    OK         0
NAT/Firewall Update Table               OK         0
DHCP External                           OK         0
IP OSI                                  OK         0
IP TTL Expired                          OK         0
IP Options Other                        OK         0
IP Options Router Alert                 OK         0
IP Multicast/Broadcast Other            OK         0
IP Multicast DHCP (SC)                  OK         0
IP Multicast Control (SC)               OK         0
IP Multicast Control (IC)               OK         0
IP Multicast VRRP                       OK         0
IP Multicast Cache Miss                 OK         0
IP Multicast Cache Miss Auto Reply      OK         0
IP Multicast Wrong Interface            OK         0
IP Local DHCP (SC)                      OK         0
IP Local Dhcp (IC)                      OK         0
IP Local Icmp Echo                      OK         0
IP Local Icmp Other                     OK         0
IP Local LDP                            OK         0
IP Local BGP                            OK         0
IP Local OSPF                           OK         0
IP Local RSVP                           OK         0
IP Local PIM                            OK         0
IP Local COPS                           OK         0
IP Local L2tp Control (SC)              OK         0
IP Local L2tp Control (IC)              OK         0
IP Local Other                          OK         0
IP Local Subscriber Interface Miss      OK         0
IP Route To SRP Ethernet                OK         0
IP Route No Route Exists                OK         0
IP Normal Path MTU                      OK         0
IP Neighbor Discovery                   OK         0
IP Neighbor Discovery Miss              OK         0
IP Search Error                         OK         0
IP MLD                                  OK         0
IP Local PIM Assert                     OK         0
IP Local BFD                            OK         0
IP IKE                                  OK         0
IP Reassembly                           OK         0
IP Local Icmp Frag                      OK         0
IP Local Frag                           OK         0
IP Application Classifier HTTP Redirect OK         0
 
Priority Information
Priority     State    Transitions
------------ ---------- -----------
Hi-Green-IC  OK         0
Hi-Yellow-IC OK         0
Lo-Green-IC  OK         0
Lo-Yellow-IC OK         1
Hi-Green-SC  OK         0
Hi-Yellow-SC OK         0
Lo-Green-SC  OK         0
Lo-Yellow-SC OK         0

Meaning

Table 105 lists the show suspicious-control-flow-detection info command output fields.

Table 105: show suspicious-control-flow-detection info Output Fields

Field Name	Field Description
Protocol Information	Protocol Information: Priority—Control protocol of the flow State OK—Protocol is currently not receiving an excess amount of traffic. Suspicious—Protocol detected as receiving an excess amount of traffic within the last backoff time in number of seconds. Transitions—Number of times this protocol has transitioned to the suspicious state
Priority Information	Priority Information: Priority—Maps a protocol to one of the priorities: dataPath Hi-Green Hi-Yellow Lo-Green Lo-Yellow State OK—Protocol is currently not receiving an excess amount of traffic. Suspicious—Protocol detected as receiving an excess amount of traffic within the last backoff time in number of seconds. Transitions—Number of times this priority has transitioned to the suspicious state

Field Name

Field Description

Protocol Information

Protocol Information:

Priority—Control protocol of the flow
State
- OK—Protocol is currently not receiving an excess amount of traffic.
- Suspicious—Protocol detected as receiving an excess amount of traffic within the last backoff time in number of seconds.
Transitions—Number of times this protocol has transitioned to the suspicious state

Priority Information

Priority Information:

Priority—Maps a protocol to one of the priorities:
- dataPath
- Hi-Green
- Hi-Yellow
- Lo-Green
- Lo-Yellow
State
- OK—Protocol is currently not receiving an excess amount of traffic.
- Suspicious—Protocol detected as receiving an excess amount of traffic within the last backoff time in number of seconds.
Transitions—Number of times this priority has transitioned to the suspicious state

Monitoring Suspicious Flow Information

Purpose

Action

Meaning

Related Documentation