Cisco routers ip accounting to see most bandwidth abusing connections


First of all, Happy New year everyone !
As I promised before (last year :) I'll look at ip accounting in Cisco world. I'll say it at the start - accounting being with us since IOS 10.0 is getting pushed aside by the powerful Netflow feature. And while it is nowhere being depreciated/end-of-lifed by Cisco , it is presented as being "not enough"for the modern enterprise.

So lets look at accounting closer.
When enabled on the interface it  creates database of accounting information containing number of bytes that passed the router  between pairs of IP addresses. There are actually more types of accounting  but here I'll talk about 2 types only: IP accounting and  IP access-list violations accounting. The first gathers statistics  for the traffic passing the router - entering and leaving it (means traffic that destined for or originating from the router itself is not accounted for). The 2nd type gives info about traffic that is being rejected by the router according to applied ACLs. Both types can be enabled for physical/logical interfaces only (so to say VTY is not in the pack).

Both types share the same database memory space. And talking about memory - by default router keeps 512 records, after these are exhausted no new accounting info is recorded. As usual , this is configurable (see later).

IP accounting

Here is a sneak preview of accounting at work:

Source           Destination              Packets               Bytes
122.94.42.91     62.20.179.36                       2                 223

What you see is Ip addresses spotted in the IP packet header as source/destination , number of packets and bytes. The database is updated continuously as traffic passes the router.

IP accounting configuration:

  • enable on the interface of interest (only outbound traffic is recorded), i.e traffic leaving interface
  • if desired tune number of kept records
  • see in CLI gathered info
  • see info through SNMP agent (won't cover here)
  • clear active accounting database and copy snapshot to checkpoint  database (done at once)
  • see later at any time snapshot in checkpoint database or active records in real-time

So here is our CLI: 1. Enable on interface

``` Router(config)#int fa0/1 Router(config-if)#ip accounting [output-packets]

2. [Optional] Tune maximum records value if desired (default 512, maximum 4294967295):
Router(config)#ip accounting-threshold 1200
3. See the active records in the database:
Router#sh ip account
Source           Destination              Packets               Bytes
68.146.13.6       162.30.79.36                       1                 129
79.82.168.224     162.30.79.36                       1                 126
142.53.125.103    162.30.79.36                    9237              423360
83.171.0.22       162.30.79.36                       1                 129
118.181.13.61     162.30.79.36                       4                 360
4. Copy active database to checkpoint database and wipe out active db records:
Router#clear ip account
Router#sh ip accounting checkpoint

Source           Destination              Packets               Bytes
68.146.13.6       162.30.79.36                       1                 129
79.82.168.224     162.30.79.36                       1                 126
142.53.125.103    162.30.79.36                    9237              423360
83.171.0.22       162.30.79.36                       1                 129
118.181.13.61     162.30.79.36                       4                 360
Usage tip: What is this good for at all? As I started in the previuos post I use such info to provide some insight to the client of what is going on (or rather going in/out) in his network at the given moment. So, all these commands I do on the client's perimeter equipment which we manage. I have no inclination to do this for client/whoever on my backbone gear, and you would be advised not to.

5.5) Some extra-bonus configs though - you may configure ACL that will filter for what IP addresses to gather accounting info only. While trying to catch who is loading your network would be counter-productive to use such filtering, for monitoring long-time  it makes sense:
Router(config)#ip accounting-list 19.90.14.59 0.0.0.0
Then to  database will be written only records involving this IP(s):
Router#sh ip account
Source           Destination              Packets               Bytes
19.90.14.59    162.30.79.37                       7                2912

``` IP access-list violations accounting.

This accounts for traffic blocked by ACL(s) applied to the interface(s) - To enable :

Router(config-if)#ip accounting access-violations

Accounting will exclude mls traffic when mls is enabled.

-  To see the records:

Router#sh ip accounting access-violations
Source           Destination              Packets               Bytes   ACL

Accounting data age is 8
  • Of course to see something you need to have some blocking ACL applied to the interface(s) beforehand. As I have no ACL on any interface this db is empty.

USAGE TIP 2: If you use this feature to spot most bandwidth abusing flow, you'll love this one-liner that after  you pass to it (through std input) output of the show ip accounting will sort data by bytes passed in ascending order: Hint  Darkstar is Linux machine, not router itself .

root@DarkStar:~# sort -n -k4,4
<NOW COPY PASTE OUTPUT FROM ROUTER HERE ...>
68.146.13.6       162.30.79.36                       1                 129
79.82.168.224     162.30.79.36                       1                 126
142.53.125.103    162.30.79.36                    9237              423360
83.171.0.22       162.30.79.36                       1                 129
118.181.13.61     162.30.79.36                       4                 360

79.82.168.224     162.30.79.36                       1                 126
83.171.0.22       162.30.79.36                       1                 129
68.146.13.6       162.30.79.36                       1                 129
118.181.13.61     162.30.79.36                       4                 360
142.53.125.103    162.30.79.36                    9237              423360

USAGE TIP 3:
To even further improve on the one-liner above below here is another one-liner that not only sorts accounting data by Bytes field but also sums up bytes per Ip address (here in the 2nd field, but you can esaily modify to your needs):

[root@DarkStar](mailto:root@DarkStar):~# sort -n -k4,4 | awk '{ips[$2] += $4} END { for (x in ips) print x,ips[x]}'
122.53.125.103   162.30.79.36                       3                 120
59.44.58.120     162.30.79.36                       3                 417
123.203.142.106  162.30.79.36                       1                 177
82.144.177.32    162.30.79.36                       1                 234
218.103.137.105  162.10.79.36                       1                 126
80.37.83.120     162.10.79.36                       1                 126
79.182.121.216   162.10.79.36                       9                 377
207.191.202.251  162.30.79.36                       9                 377
84.195.248.47    162.20.79.36                       7                 304
201.95.211.8     162.40.79.36                       8                 364
79.180.14.184    162.30.79.36                      24                 994
124.64.176.192   162.70.79.36                       5                 227
62.219.133.44    162.30.79.36                      72                3077
91.196.214.6     162.40.79.36                       4                 160
125.125.227.168  162.40.79.36                      15                 797

0
162.20.79.36 304
162.40.79.36 1321
162.30.79.36 5396
162.10.79.36 629
162.70.79.36 227
[root@DarkStar](mailto:root@DarkStar):~#

Here I'll wrap up my short memo with few links for those interested to deep digger :

  1. The whole book dedicated to knowing your network better :
    Network Management: Accounting and Performance Strategies by Benoit Claise - CCIE No. 2686; Ralf Wolter
    http://www.ciscopress.com/bookstore/product.asp?isbn=1587051982
  2. Cisco IOS command reference:
    http://www.cisco.com/en/US/docs/ios/12_3/ipaddr/command/reference/ip1_i1g.html#wp1091971

PS Next post I am planning to do on Netflow.