[Contents] [Prev] [Next] [Index] [Report an Error]

Monitoring Suspicious Control Flow

Use the commands described in this section to monitor suspicious control flows.

show suspicious-control-flow-detection counts

Use to display statistics for suspicious control flow detection. When a slot is specified, displays only information for the specific slot. If no slot is specified, displays information for all slots.
The delta keyword displays statistics for the current baseline.
Field descriptions
- Number of suspicious flows total—Total number of suspicious flows, current and past
- Number of suspicious flows current—Number of suspicious flows currently detected and monitored
- Number of groups total—Total number of groups, current and past
- Number of groups current—Number of groups currently detected and monitored
- Number of false negatives total—Total number of flows monitored that have not become suspicious (exceeded their threshold)
- Number of false negatives current—Current number of flows monitored that have not become suspicious (exceeded their threshold)
- Number of table overflows—Number of times a flow table overflows

Example

host1(config)#show suspicious-control-flow-detection counts
Suspicious Flow Detection System Counts
        Number of suspicious flows total: 0
        Number of suspicious flows current: 0
        Number of groups total: 0
        Number of groups current: 0
        Number of false negatives total: 0
        Number of false negatives current: 0
        Number of table overflows: 0

See show suspicious-control-flow-detection counts.

show suspicious-control-flow-detection flows

Use to display suspicious flows.
Field descriptions
- Interface—Interface for the flow
- Protocol—Control protocol of the flow
- MAC address—Source MAC address of the flow
- InSlot—For certain flows detected on egress, the possible ingress slot of the flow
- Rate (pps)—Rate of the flow
- Peak Rate (pps)—Peak rate of the flow
- Time Since Created—Time since the flow was determined to be suspicious, in hh:mm:sec format

Example

host1(config)# show suspicious-control-flow-detection flows
Suspicious Flow Detection System Flows
                                                          Peak            Time
                                                     In   Rate    Rate    since
Interface             Protocol        MAC address    Slot (pps)   (pps)   Create
-----------------     -------         ------------  ----- ---    -------  -------
GigabitEthernet 1/0/7 Ethernet ARP    0000.0100.0002 ---  1000030 1000050 00:00:32   
*group 3 slot 1       EthernetArpMiss 0000.0100.0003 ---  1000    3000    00:10:10

See show suspicious-control-flow-detection flows.

show suspicious-control-flow-detection info

Use to display information about suspicious flows.
You can specify the following keywords:
- delta—Displays statistics for the current baseline
- brief—Displays only suspicious information
- slot—Displays information for the specific slot
Field descriptions
- Protocol Information
  - Protocol—Control protocol of the flow
  - State
    - OK—Protocol is currently not receiving an excess amount of traffic.
    - Suspicious—Protocol detected as receiving an excess amount of traffic within the last backoff time in number of seconds.
  - Transitions—Number of times this protocol or priority has transitioned to the suspicious state
- Priority Information
  - Priority—Priorities map to a specific queue and color; priority groups are Hi-Green, Hi-Yellow, Lo-Green and Lo-Yellow.
  - State:
    - OK—Protocol is currently not receiving an excess amount of traffic
    - Suspicious—Protocol detected as receiving an excess amount of traffic within the last backoff time in number of seconds.
  - Transitions—Number of times this protocol or priority has transitioned to the suspicious state

Example

host1(config)#show suspicious-control-flow-detection info slot 2
Suspicious Flow Detection System Information
        Suspicious Flow Detection System is enabled
 
        Using Groups
 
The suspicious control flow system is not in overflow state or using groups
Protocol Information
Protocol                                State      Transitions 
--------------------------------------- ---------- -----------
Ppp Echo Request                        OK         0
Ppp Echo Reply                          OK         0
Ppp Echo Reply Fastpath                 OK         0
Ppp Control                             OK         0
Atm Control (ILMI)                      OK         0
Atm OAM                                 OK         0
Atm Dynamic Interface Column Creation   OK         0
Atm Inverse ARP                         OK         0
Frame Relay LMI Control                 OK         0
Frame Relay Inverse Arp                 OK         0
Pppoe Control                           OK         0
Pppoe Config Dynamic Interface Column   OK         0
 Creation
Ethernet ARP Miss                       OK         0
Ethernet ARP                            OK         0
Ethernet LACP packet                    OK         0
Ethernet Dynamic Interface Column       OK         0
 Creation
Slep SLARP                              OK         0
MPLS TTL Exceeded On Receive            OK         0
MPLS TTL Exceeded On Transmit           OK         0
MPLS MTU Exceeded                       OK         0
Ipsec Transport Mode L2tp Control       OK         0
NAT/Firewall Payload                    OK         0
NAT/Firewall Update Table               OK         0
DHCP External                           OK         0
IP OSI                                  OK         0
IP TTL Expired                          OK         0
IP Options Other                        OK         0
IP Options Router Alert                 OK         0
IP Multicast/Broadcast Other            OK         0
IP Multicast DHCP (SC)                  OK         0
IP Multicast Control (SC)               OK         0
IP Multicast Control (IC)               OK         0
IP Multicast VRRP                       OK         0
IP Mulitcast Cache Miss                 OK         0
IP Multicast Cache Miss Auto Reply      OK         0
IP Multicast Wrong Interface            OK         0
IP Local DHCP (SC)                      OK         0
IP Local Dhcp (IC)                      OK         0
IP Local Icmp Echo                      OK         0
IP Local Icmp Other                     OK         0
IP Local LDP                            OK         0
IP Local BGP                            OK         0
IP Local OSPF                           OK         0
IP Local RSVP                           OK         0
IP Local PIM                            OK         0
IP Local COPS                           OK         0
IP Local L2tp Control (SC)              OK         0
IP Local L2tp Control (IC)              OK         0
IP Local Other                          OK         0
IP Local Subscriber Interface Miss      OK         0
IP Route To SRP Ethernet                OK         0
IP Route No Route Exists                OK         0
IP Normal Path MTU                      OK         0
IP Neighbor Discovery                   OK         0
IP Neighbor Discovery Miss              OK         0
IP Search Error                         OK         0
IP MLD                                  OK         0
IP Local PIM Assert                     OK         0
IP Local BFD                            OK         0
IP IKE                                  OK         0
IP Reassembly                           OK         0
IP Local Icmp Frag                      OK         0
IP Local Frag                           OK         0
IP Application Classifier HTTP Redirect OK         0
 
Priority Information
Priority     State    Transitions
------------ ---------- -----------
Hi-Green-IC  OK         0
Hi-Yellow-IC OK         0
Lo-Green-IC  OK         0
Lo-Yellow-IC OK         1
Hi-Green-SC  OK         0
Hi-Yellow-SC OK         0
Lo-Green-SC  OK         0
Lo-Yellow-SC OK         0

See show suspicious-control-flow-detection info.

show suspicious-control-flow-detection protocol

Use to display protocol information for suspicious control flows.
Field descriptions
- Protocol—Control protocol
- Threshold—Threshold in packets per second
- Lo-Threshold—Low threshold in packets per second
- Backoff-Time—Backoff time in seconds

Example

host1(config)#show suspicious-control-flow-detection protocol 
Protocol                       Threshold Lo-Threshold Backoff-Time
------------------------------ --------- ------------ ------------
Ppp Echo Request                      10            5          300
Ppp Echo Reply                        10            5          300
Ppp Echo Reply Fastpath               10            5          300
Ppp Control                           10            5          300
Atm Control (ILMI)                    10            5          300
Atm OAM                               10            5          300
Atm Dynamic Interface Column          10            5          300
 Creation
Atm Inverse ARP                       10            5          300
Frame Relay LMI Control               10            5          300
Frame Relay Inverse Arp               10            5          300
Pppoe Control                        512          256          300
Pppoe Config Dynamic Interface        10            5          300
 Column Creation
Ethernet ARP Miss                    128           64          300
Ethernet ARP                         128           64          300
Ethernet LACP packet                  10            5          300
Ethernet Dynamic Interface           512          256          300
 Column Creation
Slep SLARP                           128           64          300
MPLS TTL Exceeded On Receive          10            5          300
MPLS TTL Exceeded On Transmit         10            5          300
MPLS MTU Exceeded                     10            5          300
Ipsec Transport Mode L2tp           2048         1024          300
 Control
NAT/Firewall Payload                 512          256          300
NAT/Firewall Update Table            512          256          300
DHCP External                       1024          512          300
IP OSI                              2048         1024          300
IP TTL Expired                        10            5          300
IP Options Other                     512          256          300
IP Options Router Alert             2048         1024          300
IP Multicast/Broadcast Other         512          256          300
IP Multicast DHCP (SC)               512          256          300
IP Multicast Control (SC)           2048         1024          300
IP Multicast Control (IC)            512          256          300
IP Multicast VRRP                    512          256          300
IP Mulitcast Cache Miss              128           64          300
IP Multicast Cache Miss Auto Reply   128           64          300
IP Multicast Wrong Interface          10            5          300
IP Local DHCP (SC)                   512          256          300
IP Local Dhcp (IC)                   512          256          300
IP Local Icmp Echo                   512          256          300
IP Local Icmp Other                  128           64          300
IP Local LDP                        2048         1024          300
IP Local BGP                        2048         1024          300
IP Local OSPF                         64           32          300
IP Local RSVP                       2048         1024          300
IP Local PIM                        2048         1024          300
IP Local COPS                       2048         1024          300
IP Local L2tp Control (SC)          2048         1024          300
IP Local L2tp Control (IC)           512          256          300
IP Local Other                       512          256          300
IP Local Subscriber Interface Miss   512          256          300
IP Route To SRP Ethernet             512          256          300
IP Route No Route Exists              10            5          300
IP Normal Path MTU                    10            5          300
IP Neighbor Discovery                128           64          300
IP Neighbor Discovery Miss           128           64          300
IP Search Error                       10            5          300
IP MLD                               512          256          300
IP Local PIM Assert                  512          256          300
IP Local BFD                        1024          512          300
IP IKE                               512          256          300
IP Reassembly                       2048         1024          300
IP Local Icmp Frag                   512          256          300
IP Local Frag                        512          256          300
IP Application Classifier HTTP       128           64          300
 Redirect

See show suspicious-control-flow-detection protocol.

show snmp interfaces

Use to display a list of interface types that are compressed in the interface tables and the interface numbering method configured on the router.
Field descriptions
- Compressed(Removed) Interface Types—List of interface types that are removed from the ifTable and ifStackTable
- Armed Interface Numbering Mode—Interface numbering method configured on the router: RFC1213, RFC2863
- maxIfIndex—Maximum value that the system will allocate to the ifIndex field
- maxIfNumber—Maximum number of interfaces allowed in the ifTable
- Interface Description Setting—Method used to encode the ifDescr and ifName objects: common, legacy, proprietary

Example

host1#show snmp interfaces
Compressed(Removed) Interface Types:
HDLC, FT1, ATM, ATM1483
Armed Interface Numbering Mode:
RFC1213, maxIfIndex=65535, maxIfNumber=65535
Interface Description Setting: proprietary

See show snmp interfaces.

[Contents] [Prev] [Next] [Index] [Report an Error]