Contents

Flow group commands· 1

display telemetry flow-group· 1

display telemetry flow-group flow-table· 2

if-match acl 4

telemetry apply flow-group· 5

telemetry flow-group· 6

telemetry flow-group aging-time· 6

template· 7

 

Flow group commands

display telemetry flow-group

Use display telemetry flow-group to display the configuration and application status of flow groups.

Syntax

display telemetry flow-group [ group-id | name group-name ] [ slot slot-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

group-id: Specifies a flow group by its ID. The value range for this argument is 1 to 7.

name group-name: Specifies a flow group by its name, a case-sensitive string of 1 to 63 characters.

slot slot-number: Specifies the slot number of the device, which is fixed at 1.

Usage guidelines

If you do not specify the group-id or name group-name option, this command displays the configuration and application status of all flow groups.

Examples

# Display the configuration of flow group 1 and its application status in slot 1.

<Sysname> display telemetry flow-group 1 slot 1

Flow group 1 (Failed)

  ACL     : 2001 (The ACL doesn't exist.)

  Template:

    destination-ip

    destination-port

    source-ip

    source-port

    vxlan

      inner-destination-ip

      inner-source-ip

  Mode    : Common-MOD

Configured aging time: 100 milliseconds

Table 1 Command output

Field	Description
Flow group 1 (Failed)	Name of the flow group. Values for the application status include: ·     Successful—The flow group is applied successfully. ·     Failed—The flow group fails to be applied for some reasons other than incomplete flow group configuration. ·     Inactive—The flow group has not been administratively applied. ·     Incomplete—The flow group fails to be applied because its configuration is incomplete.
Mode	The mode specified when a flow group is applied: ·     Common-MOD ·     Mice-elephant-flow
Apply mode	The mode specified when a flow group is applied: ·     Common-MOD Values for the application status include: ·     Successful—The flow group is applied successfully. ·     Failed—The flow group fails to be applied for some reasons other than incomplete flow group configuration. ·     Inactive—The flow group has not been administratively applied.
Active aging time	Aging time that actually takes effect.

‌

display telemetry flow-group flow-table

Use display telemetry flow-group flow-table to display the flow entries generated by flow groups.

Syntax

display telemetry flow-group flow-table [ [ group-id | name group-name ] | mod ] [ destination-ip { dst-ipv4 | dst-ipv6 } | destination-port dst-port | protocol protocol | source-ip { src-ipv4 | src-ipv6 } | source-port src-port ] * { slot slot-number }

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

group-id: Specifies a flow group by its ID. The value range for this argument varies by device model.

name group-name: Specifies a flow group by its name, a case-sensitive string of 1 to 63 characters.

mod: Specifies flow groups in MOD mode and flow groups in simple MOD mode.

destination-ip { dst-ipv4 | dst-ipv6 }: Specifies the destination IPv4 or IPv6 address.

destination-port dst-port: Specifies the destination port number.

protocol protocol: Specifies the network layer protocol.

source-ip { src-ipv4 | src-ipv6 }: Specifies the source IPv4 or IPv6 address.

source-port src-port: Specifies the source port number.

slot slot-number: Specifies the slot number of the device, which is fixed at 1.

Usage guidelines

If you do not specify flow groups, this command displays the flow entries generated by each flow group.

Examples

# Display the flow entries generated by flow group 1 for slot 1.

<Sysname> display telemetry flow-group flow-table 1 slot 1

Slot: 1

Flow group 1 (name: abc)

Mode: Mice elephant flow

================================================================================

Src IP          Dst IP          Pro SPort DPort Aging    Packets

In Src IP       In Dst IP       InP InSP  InDP  VXLAN ID Bytes

Drop Reason

================================================================================

192.168.1.86    192.168.10.2    6   20    30    12m10s   10

-               -               -   -     -     -        12400

unknown-vlan

Table 2 Command output

Field	Description
Mode	Flow group mode: ·     Mice elephant flow—Elephant/mice flow mode.
Packet	Packet count.
In Src IP	Inner source IP address of VXLAN packets.
In Dst IP	Inner destination IP address of VXLAN packets.
InP	Inner network layer protocol.
InSP	Inner source port number.
InDP	Inner destination port number.
VXLAN ID	VXLAN ID.
Bytes	Byte count.
Drop Reason	Packet drop reason: ·     car-exceeded—Packet rate exceeded CAR. ·     higig-header-error—HiGig header error. ·     invalid-tpid—Invalid TPID. ·     ip-multicast-error—IP multicast packet error. ·     ipv4-dip-miss—The destination IPv4 address of a packet does not match a route or matches the default route. ·     ipv4-l3-header-error—IPv4 header error. ·     ipv6-dip-miss—The destination IPv6 address of a packet does not match a route or matches the default route. ·     parity-error—Parity error. ·     tunnel-header-error—Tunnel packet header error. ·     unknown-vlan—Unknown VLAN.

‌

if-match acl

Use if-match acl to specify an ACL for a flow group.

Use undo if-match acl to remove an ACL from a flow group.

Syntax

if-match acl [ ipv6 | mac ] { acl-number | name acl-name }

undo if-match acl

Default

No ACL is specified for a flow group.

Views

Flow group view

Predefined user roles

network-admin

Parameters

ipv6: Specifies the IPv6 ACL type.

mac: Specifies the Layer 2 ACL type.

acl-number: Specifies the ACL number. The following are available value ranges:

·     2000 to 2999 for basic ACLs.

·     3000 to 3999 for advanced ACLs.

·     4000 to 4999 for Layer 2 ACLs.

name acl-name: Specifies the ACL name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter.

Usage guidelines

When specifying an ACL, follow these restrictions and guidelines:

·     If the specified ACL does not exist or does not have any rules, no traffic will match the ACL.

·     In the specified ACL, whether an ACL rule supports the vpn-instance keyword and how the vpn-instance keyword takes effect vary by device model.

When specifying an ACL by its number, follow these rules:

·     To specify an IPv4 ACL, specify only its number.

·     To specify an IPv6 ACL or Layer 2 ACL, you must specify both its type and number.

When specifying an ACL by its name, follow these rules:

·     To specify an IPv4 ACL, specify only its name.

·     To specify an IPv6 ACL or Layer 2 ACL, you must specify both its type and name.

A flow group takes effect only on the traffic that matches the specified ACL.

Only one ACL can be specified for a flow group.

Examples

# Specify ACL 3000 in flow group 1.

<Sysname> system-view

[Sysname] telemetry flow-group 1

[Sysname-telemetry-flow-group-1] if-match acl 3000

Related commands

acl (ACL and QoS Command Reference)

telemetry flow-group

telemetry apply flow-group

Use telemetry apply flow-group to apply a flow group.

Use undo telemetry apply flow-group to remove the application of a flow group.

Syntax

telemetry apply flow-group { group-id | name group-name }

undo telemetry apply flow-group { group-id | name group-name | system-defined ip mode mice-elephant-flow }

Default

No flow group is applied.

Views

System view

Predefined user roles

network-admin

Parameters

group-id: Specifies a flow group by its ID. The value range for this argument is 1 to 7.

name group-name: Specifies a flow group by its name, a case-sensitive string of 1 to 63 characters.

mode: Specifies an application mode for a system-defined flow group..

·     mice-elephant-flow: Specifies the mice-elephant-flow application mode.

Usage guidelines

The device has a system-defined flow group named system-defined-ip, which is not configurable.

The system-defined flow group generates flow entries based on the 5-tuple and takes effect on all traffic.

Examples

# Apply flow group 1.

<Sysname> system-view

[Sysname] telemetry apply flow-group 1

# Apply the system-defined IP flow group with the mice/elephant flow mode.

<Sysname> system-view

[Sysname] telemetry apply flow-group system-defined ip mode mice-elephant-flow

Related commands

telemetry flow-group

telemetry flow-group

Use telemetry flow-group to create a flow group and enter its view, or enter the view of an existing flow group.

Use undo telemetry flow-group to delete a flow group.

Syntax

telemetry flow-group group-id [ name group-name ]

undo telemetry flow-group { group-id | name group-name }

Default

No flow groups exist.

Views

System view

Predefined user roles

network-admin

Parameters

group-id: Specifies a flow group ID. The value range for this argument is 1 to 7.

name group-name: Specifies a flow group name, a case-sensitive string of 1 to 63 characters. The name must be globally unique and cannot start with system-defined-.

Usage guidelines

You cannot name or rename an existing flow group.

To delete an applied flow group, first remove the application and then delete the flow group.

Examples

# Create flow group 1 and enter its view.

<Sysname> system-view

[Sysname] telemetry flow-group 1

[Sysname-telemetry-flow-group-1]

telemetry flow-group aging-time

Use telemetry flow-group aging-time to set the aging time for flow entries.

Use undo telemetry flow-group aging-time to restore the default.

Syntax

telemetry flow-group aging-time msec aging-time

undo telemetry flow-group aging-time

Default

The aging time for flow entries is 10 milliseconds.

Views

System view

Predefined user roles

network-admin

Parameters

msec aging-time: Specifies the aging time for flow entries, in milliseconds. Valid values are 1, 2, 5, and 10.

Examples

# Set the aging time for flow entries to 5 milliseconds.

<Sysname> system-view

[Sysname] telemetry flow-group aging-time 5

template

Use template to configure a flow entry generation rule.

Use undo template to delete a flow entry generation rule.

Syntax

template { destination-ip | destination-port | protocol | source-ip | source-port } *

undo template

Default

No flow entry generation rule is configured.

Views

System view

Predefined user roles

network-admin

Parameters

destination-ip: Generates flow entries based on the destination IP address.

destination-port: Generates flow entries based on the destination port number.

protocol: Generates flow entries based on the Layer 3 protocol type.

source-ip: Generates flow entries based on the source IP address.

source-port: Generates flow entries based on the source port number.

Usage guidelines

This command enables the device to identify traffic and generate flow entries based on the specified header fields.

Examples

# Configure flow group 1 to generated flow entries based on the source IP address, destination IP address, source port number, and destination port number.

<Sysname> system-view

[Sysname] telemetry flow-group 1

[Sysname-telemetry-flow-group-1] template destination-ip destination-port source-ip source-port

Related commands

telemetry flow-group