IP accounting

binarysoul

I've heard of 'IP accounting' too many times.

What's the purpose of enabling 'IP accouting' on a router? Do you use this a lot?

Which commands are involve?

dtlokee

core_ro(config-if)#ip accounting ?
  access-violations  Account for IP packets violating access lists on this
                     interface
  mac-address        Account for MAC addresses seen on this interface
  output-packets     Account for IP packets output on this interface
  precedence         Count packets by IP precedence on this interface
  <cr>

core_ro(config-if)#

core_ro#sh interface fa0/0 accounting
FastEthernet0/0
                Protocol    Pkts In   Chars In   Pkts Out  Chars Out
                   Other      35674    1937532      97542    5852520
                      IP     513762  125844094    3856787  425483843
                 DEC MOP          0          0       1623     124971
                     ARP       5805     348300       1226      73904
                     CDP      16267    6688013      16289    5563169
core_ro#

Basically as the name implies it keeps track of the total number of packets on the interface. It can be used to track different things about the traffic flows, and can writ this information to a NMS via SNMP

hectorjhrdz

also if you issue the sh ip accounting command on pirvilege mode
the output will show you the layer 3 info of the packets flowing on that interface:


interface Serial1/4:10
description **xxxxxxxxxx **
ip address xxxxxxxxxxxxxxxx
ip access-group xxx in
ip accounting output-packets
end



xxxxxxxxx#sh ip accounting

Source Destination Packets Bytes
<ip addr> <ip addr> 6 301
<ip addr> <ip addr> 7 1766

Accounting data age is 1

It's useful when you want to know what ip address is using the more bw of your link.For example when it's saturated you can know the ip addr to block it, sometimes user machines get some viruses that have'em send much traffic to any destination.

I skipped the ip numbers because obvious reasons :P


cheers