<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div><br></div><div>3rd option could be sub-interface for different address family</div><div><br></div><div>-R</div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> "Md. Abdul Awal" <<a href="mailto:awal.ece@gmail.com">awal.ece@gmail.com</a>><br><span style="font-weight:bold">Date: </span> Wednesday, 23 July 2014 12:02 PM<br><span style="font-weight:bold">To: </span> Brian Candler <<a href="mailto:brian@nsrc.org">brian@nsrc.org</a>>, "<a href="mailto:aniruddha.barua@colbd.com">aniruddha.barua@colbd.com</a>" <<a href="mailto:aniruddha.barua@colbd.com">aniruddha.barua@colbd.com</a>><br><span style="font-weight:bold">Cc: </span> "<a href="mailto:nog@bdnog.org">nog@bdnog.org</a>" <<a href="mailto:nog@bdnog.org">nog@bdnog.org</a>><br><span style="font-weight:bold">Subject: </span> Re: [bdNOG] How to separate IPv6 and IPv4 traffic in a dual-stack interface<br></div><div><br></div><div><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><div><div dir="ltr">Dear Brian and Aniruddha Bhai,
<div><br></div><div>Thanks for your advice. I'll try both of the ways.</div><div><br></div><div>BR//Awal</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jul 22, 2014 at 2:02 PM, Brian Candler <span dir="ltr">
<<a href="mailto:brian@nsrc.org" target="_blank">brian@nsrc.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">On 21/07/2014 07:36, Md. Abdul Awal wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I'm looking for measuring IPv6 traffic in a dual-stack interface. Would anyone help me with some idea on how I can plot IPv6 and IPv4 traffic in separate graph from the same interface (i.e dual-stack)?<br></blockquote></div>
What kind of device are you thinking of?<br><br>
One way to do it is using Netflow. Generate Netflow records for both IPv4 and IPv6 traffic, and then when they arrive at your collector (e.g. nfdump+nfsen) it can filter them out and draw different graphs. Or, you can send netflow packets for IPv4 and IPv6
traffic to separate UDP ports so that they're already separated out (but then you'd have to sum them if you want a graph of total traffic).<br><br>
For Cisco IOS (15.x), you need to use the new "flexible netflow" CLI syntax to enable netflow for IPv6; the old syntax will only record IPv4 traffic.<br><br>
Here is some sample config:<br><br>
rtrX# configure terminal<br>
rtrX(config)# flow exporter EXPORTER-1<br>
rtrX(config-flow-exporter)# description Export to collector<br>
rtrX(config-flow-exporter)# destination x.x.x.x<br>
rtrX(config-flow-exporter)# transport udp 9001<br>
rtrX(config-flow-exporter)# template data timeout 300<br>
rtrX(config-flow-exporter)# flow monitor FLOW-MONITOR-V4<br>
rtrX(config-flow-monitor)# exporter EXPORTER-1<br>
rtrX(config-flow-monitor)# record netflow ipv4 original-input<br>
rtrX(config-flow-monitor)# cache timeout active 300<br>
rtrX(config-flow-monitor)# flow monitor FLOW-MONITOR-V6<br>
rtrX(config-flow-monitor)# exporter EXPORTER-1<br>
rtrX(config-flow-monitor)# record netflow ipv6 original-input<br>
rtrX(config-flow-monitor)# cache timeout active 300<br>
rtrX(config)# interface FastEthernet 0/0<br>
rtrX(config-if)# ip flow monitor FLOW-MONITOR-V4 input<br>
rtrX(config-if)# ip flow monitor FLOW-MONITOR-V4 output<br>
rtrX(config-if)# ipv6 flow monitor FLOW-MONITOR-V6 input<br>
rtrX(config-if)# ipv6 flow monitor FLOW-MONITOR-V6 output<br>
rtrX(config-if)# exit<br>
rtrX(config)# snmp-server ifindex persist<br><br>
(If you want to send the v4 and v6 netflow data to different UDP ports, you create another flow exporter say EXPORTER-2 to udp port 9002, and bind the FLOW-MONITOR-V6 to that exporter)<br><br>
There's no direct equivalent to "top talkers" in this syntax, but you can run long aggregation commands like this:<br><br>
rtrX# show flow monitor FLOW-MONITOR-V4 cache aggregate ipv4 source address ipv4 destination address sort counter bytes top 20<br><br>
(and you can make command aliases to make this easier to type). That command shows the top twenty (src IP, dst IP) pairs by bytes of IPv4 sent. You can make a few simple changes to that command to make it show IPv6 traffic instead.<br><br>
Regards,<br><br>
Brian.<br><br></blockquote></div><br></div></div></div></span></body></html>