1

I have access-lists in place. When i use the show ip access-list command, some of access-lists show counters (hit counts), and some don't. If I change the rule from permit to deny, interesting traffic is denied and counters will appear, but when I change to permit again the counters won't increase, although there is the traffic which is allowed with same sequence number.

Improve this question
1
  • 1
    if it does not have a hit, it would indicate that there is no matching traffic, however, without seeing the ACL and the IP/Source that is passing i could only guess
    – psniffer
    Jan 12, 2017 at 13:35

1 Answer 1

Reset to default
3

If the platform is Cisco Catalyst as reflected in the tags for the question, that may be the case. Some platforms reflect only punted (soft-switched) packets in the "show ip access-list [...]" output, while others reflect none. For example, for Catalyst 6500 and Sup720 You'd need to use show tcam int x/y acl in|out protocol, while for other Catalyst platforms You'd usually be able to see aggregated statistics for ASIC or whole box via show access-list hardware counters.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.