1

I am trying to understand the definition of "input" and "output" traffic to an interface.


Below is extracted from Flexible NetFlow Documentation in Cisco 3850 ->

If you apply a flow monitor in the input direction:
• Use the match keyword and use the input interface as a key field.
• Use the collect keyword and use the output interface as a collect field. This field will be present in the exported records but with a value of 0.

• If you apply a flow monitor in the output direction:
• Use the match keyword and use the output interface as a key field.
• Use the collect keyword and use the input interface as a collect field. This field will be present in the exported records but with a value of 0.


  1. When traffic ingresses into Gi1/0/1 and needs to egress out of gi1/0/2, is that traffic considered as "input" or "output" to gi1/0/2?
  2. I can't twist my head around on why, if I apply a flow in the input direction, I have to collect output interface, and that field will be value 0?
0

You need to understand in which direction you want to collect information. Normally, you only want to collect statistics in a single direction, either input or output, but not both. Collecting information in both directions will double-count your traffic. Many people start out trying to collect both input and output on every interface, but find that doesn't really give them a good picture.

For example, if you only have input collection on a router's interfaces, you will be counting all traffic entering the router, and your traffic will only be counted once. If you have both input and output collection on a router, then traffic will be counted as it enters the router and again when it leaves the router, and this can distort your statistics, making it look like your router is routing twice as much traffic.

  • thanks for your reply. For traffic that is being switched/routed to a switchport waiting to egress out, that is as consider "output" right ? e.g. traffic enter into gi1/0/1 and need to egress out of gi1/0/2 ? – Noob Sep 24 '17 at 7:02
  • Yes. You call the traffic direction from the router's perspective. What is coming into the router is input, and what is leaving the router is output. – Ron Maupin Sep 24 '17 at 7:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.