This is a short article on the NetFlow “top-talkers” CLI feature, which I didn’t know about before today. NetFlow is a tool for monitoring traffic flows, it’s particulalry handy when you’re trying to find out what host or protocol is saturating a network. Obviously the pretty GUI NetFlow collectors are better for many things, but the CLI method can be really helpful if you’re looking for something quickly. Here’s the config:

Here’s the config from my outside interface.

interface FastEthernet0/0
 description OUTSIDE
 ip address xx.xx.29.218
 ip flow ingress
 ip flow egress

I’ve enabled NetFlow with the “ip flow” commands.

Here are the commands to enable the “top-talkers” feature at the CLI.

EDGE(config)#ip flow-top-talkers
EDGE(config-flow-top-talkers)# top 25
EDGE(config-flow-top-talkers)# sort-by bytes
EDGE(config-flow-top-talkers)# cache-timeout 5000

Pretty simple, we’ve set how many conversations to show, then we can sort by bytes or packets, finally we set our timeout (in milliseconds).

Now we’ll look at the show command:

EDGE#sh ip flow top-talkers
SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP Bytes
Fa0/1         xx.xx.29.221    Fa0/0*   06 F6B9 9C40    77K
Fa0/1         xx.xx.29.218    Fa0/0*  06 01BB EF24    12K
Fa0/1         xx.xx.29.221    Fa0/0*   06 7F23 EC43    10K
Fa0/1         xx.xx.29.221    Fa0/0*  06 7F23 0CB7  9216
Fa0/0  Fa0/1         xx.xx.29.221    06 EC74 7F23  5088
Fa0/0  Fa0/1         xx.xx.29.218    06 EF24 01BB  2680
Fa0/0  Fa0/1         xx.xx.29.221    06 0E20 7F23  2297
Fa0/1         xx.xx.29.221    Fa0/0*  06 7F23 0E20  2162
Fa0/0  Fa0/1         xx.xx.29.221    06 C220 7F23  2100
Fa0/1         xx.xx.29.221    Fa0/0*  06 7F23 C220  2072
Local         xx.xx.29.218    Fa0/0*    32 033B B7EC  2000
Fa0/0   Fa0/1         xx.xx.29.221    06 D788 7F23  1838
Fa0/1         xx.xx.29.221    Fa0/0*   06 7F23 D788  1832
Fa0/1         xx.xx.29.221    Fa0/0*    06 7F23 F5BC  1717
Fa0/0   Fa0/1         xx.xx.29.221    06 9C40 F6B9  1276
Fa0/0    Fa0/1         xx.xx.29.221    06 F5BC 7F23  1067
Fa0/1         xx.xx.29.218    Fa0/0*   06 1853 0050   872
Fa0/1         xx.xx.29.221    Fa0/0* 06 7F23 8736   868
Fa0/0  Local         xx.xx.29.218    2F 0000 0000   816
Fa0/0    Fa0/1         xx.xx.29.221    06 DABF 7F23   767
Fa0/0   Fa0/1         xx.xx.29.221    06 08A8 7F23   617
Tu103         xx.xx.29.218    Fa0/0*  32 0CED D9C9   616
Fa0/0   Fa0/1         xx.xx.29.218    06 0050 1853   594
Fa0/1         xx.xx.29.221    Fa0/0*   06 7F23 08A8   499
Fa0/0    Fa0/1         xx.xx.29.221    06 1F37 C0E5   372