The QoS Packet-Matching Statistics: Per Filter feature allows you to count and display the number of packets and bytes matching a filter.

To define a filter, use the class-map command with the match-any keyword, for example:

class-map match-any my_class
   match ip precedence 4 <-------- User-defined filter
   match qos-group 10 <-------- User-defined filter

Using this information, you can perform the following tasks:

• Compare the amount of voice traffic with the amount of data traffic on a segment of your network

• Adjust bandwidth availability

• Accurately determine billing

• Troubleshoot service problems

The system collects packet matching statistics in 10-second cycles. If there are many interfaces or sessions, the system collects statistics for about 8000 of them during each cycle. In a scaled configuration, several 10-second cycles may be required to gather all the statistics.

The QoS Packet-Matching Statistics: Per ACE feature allows you to track and display the number of packets and bytes matching individual ACEs that are used in QoS policies (access groups used in class maps).

This feature provides hit counters for ACEs used in QoS policies. When this feature is enabled, it will add QoS hit counters for the ACEs used in a QoS policy to the existing security access list counters for that particular ACE. The access list counters can be seen in the following command output:

Router# show ip access-lists

Extended IP access list A1
    10 permit ip 32.1.1.0 0.0.0.255 any (129580275 matches)
Extended IP access list A6and7
    10 permit ip 32.1.6.0 0.0.0.255 any (341426749 matches)
    20 permit ip 32.1.7.0 0.0.0.255 any (398245767 matches)
Extended IP access list source
    10 permit ip any host 16.1.1.5 (16147976 matches)

The QoS hit counters (for the ACEs used in QoS policies) will be added to the access list counters. We recommend that you pay attention to the following points when you enable this feature:

• Access list counts are not interface specific, as can be seen in the output of the show ip access-lists command (there is no mention of interface). They are aggregate counters of all the hits, for all the features that use the ACEs and support the counts, across all interfaces and directions.

• Interface-specific counts are provided in the existing QoS command(show policy-map interface) if the QoS Packet-Matching Statistics: Per Filter feature is enabled. However, the command specified previously shows only the counts per filter (ACL or access group), not per ACE, as can be seen in the following sample output:

Router# show access-lists  
       
Extended IP access list A1
    10 permit ip 32.1.1.0 0.0.0.255 any (2000 matches)

Router# show policy-map interface GigabitEthernet0/0/2

  Service-policy input: simple

    Class-map: A1-class (match-all)
      1000 packets, 124000 bytes
      5 minute offered rate 4000 bps
      Match: access-group name A1

    Class-map: class-default (match-any)
      0 packets, 0 bytes
      5 minute offered rate 261000 bps, drop rate 0 bps
      Match: any 

• If an ACE is present in a QoS filter (match statement within a class map), but the packet does not match the statement, the ACE counter will not be incremented for that packet. This can happen if:

  • The ACE is used in a deny statement.

  • Other matching criteria in a match-all class map definition (such as match ip prec 1) prevent the packet from matching the class.

  • Other matching criteria in a match-any class map definition (such as match ip prec 1) match the packet and keep it from matching the ACE match criteria. (This filter precedes the ACE filter and the packet matches both the statements).

• Access list counts are an aggregate (for a particular ACE) of the hit counts for all the features using that ACE, and support the per ACE counts. (In Cisco IOS XE3.10, only Security and QoS ACLs support per ACE counts, but that may change in future releases). Therefore, it is possible that a single packet will hit (and be counted by) multiple features using the same ACE and hence result in multiple counts for the same packet (as it traverses each feature). The following is an example of this:

ip access-list extended A1
  permit ip 32.1.1.0 0.0.0.255 any
class-map match-all A1-class
  match access-group name A1

interface GigabitEthernet0/0/2
 ip address 32.0.0.1 240.0.0.0
 ip access-group A1 in
 duplex auto
 speed auto
 media-type rj45
 no negotiation auto
 service-policy input simple


Router# show access-lists         

Extended IP access list A1
    10 permit ip 32.1.1.0 0.0.0.255 any (2000 matches)

Router# show policy-map interface GigabitEthernet0/0/2 

  Service-policy input: simple

    Class-map: A1-class (match-all)
      1000 packets, 124000 bytes
      5 minute offered rate 4000 bps
      Match: access-group name A1

    Class-map: class-default (match-any)
      0 packets, 0 bytes
      5 minute offered rate 261000 bps, drop rate 0 bps
      Match: any 

Before You Begin

• Before enabling the QoS Packet-Matching Statistics: Per Filter feature, ensure that no policy-maps are associated with the interfaces on the system. If they are, the system returns the following message:

Either a) A system RELOAD or
       b) Remove all service-policies, re-apply the change
            to the statistics, re-apply all service-policies
			is required before this command will be activated.

• Before enabling the QoS Packet-Matching Statistics: Per Filter feature, ensure that you have defined a filter that is using the class-map command with the match-any keyword.

Note	Enabling the QoS Packet-Matching Statistics: Per Filter feature may increase CPU utilization on a scaled configuration. Before enabling the QoS Packet-Matching Statistics: Per Filter feature, weigh the benefits of the statistics information against an increase in CPU utilization for your system.

To configure the QoS Packet-Matching Statistics: Per Filter feature, perform the following procedure:

1.    enable


2.    configure terminal


3.    platform qos match-statistics per-filter


4.    interface interface -name


5.    service-policy {input | output} policy-map-name

6.    end


7.    show policy-map interface interface-name


8.    configure terminal


9.    interface interface-name


10.    no service-policy {input | output} policy-map-name


11.    exit


12.    no platform qos match-statistics per-filter


13.    end

Router> enable

Router# configure terminal

Router(config)# platform qos match-statistics per-filter

Router(config)# interface GigabitEthernet0/0/0

Router(config-if)# service-policy input pol1

Router# end

Router# show policy-map interface serial4/0/0

Router# configure terminal

Router(config)# interface GigabitEthernet0/0/0

Router(config-if)# no service-policy input pol1

Router(config-if)# exit

Router(config)# no platform qos match-statistics per-filter

Router# end

Router# show policy-map interface gig1/1/0

 GigabitEthernet1/1/0 
  Service-policy input: pol1					! target = gig1/1/0,input 
    Class-map: class1 (match-any)  
      1000 packets, 40000 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: ip precedence 1 <-------- User-defined filter
        800 packets, 32000 bytes <-------- Filter matching results
      Match: ip precedence 2 <-------- User-defined filter
        200 packets, 8000 bytes <-------- Filter matching results
      QoS Set
        ip precedence 7
          No packet marking statistics available
    Class-map: class-default (match-any)  
      500 packets, 20000 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: any <-------- User-defined filter
        500 packets, 20000 bytes <-------- Filter matching results

Router# show platform hardware qfp active feature qos configuration global
Marker statistics are: disabled
Match per-filter statistics are: enabled <<<<<<<
Match per-ace statistics are: enabled <<<<<<
Performance-Monitor statistics are: disabled

1.    enable


2.    configure terminal


3.    platform qos match-statistics per-filter


4.    platform qos match-statistics per-ace


5.    interface interface-name


6.    service-policy{input|output}policy-map-name

7.    end


8.    show policy-map interface interface-name


9.    show access-lists


10.    configure terminal


11.    interface interface-name


12.    no service-policy{input|output}policy-map-name

13.    exit


14.    no platform qos match-stat per-ace


15.    no platform qos match-statistics per-filter


16.    end

Router> enable

Router# configure terminal

Router(config)# platform qos match-statistics per-filter

Router(config)# platform qos match-statistics per-ace

Router(config)# interface GigabitEthernet0/0/0

Router(config-if)# service-policy input pol1

Router# end

Router# show policy-map interface serial4/0/0

Router# show access-lists

Router# configure terminal

Router(config)# interface GigabitEthernet0/0/0

Router(config-if)# no service-policy input pol1

Router(config-if)# exit

Router(config)# no platform qos match-stat per-ace

Router(config)# no platform qos match-statistics per-filter

Router# end

Router# show policy-map interface GigabitEthernet0/0/2

 
  Service-policy input: test-match-types

    Class-map: A1orA2-class (match-any)
      482103366 packets, 59780817384 bytes
      5 minute offered rate 6702000 bps
      Match: access-group name A1
        62125633 packets, 7703578368 bytes
        5 minute rate 837000 bps
      Match: access-group name A2
        419977732 packets, 52077238892 bytes
        5 minute rate 5865000 bps

    Class-map: A3andprec1-class (match-all)
      5673520 packets, 703516480 bytes
      5 minute offered rate 837000 bps
      Match: access-group name A3
      Match: ip precedence 1 

    Class-map: A5-class (match-all)
      227101820 packets, 28160625680 bytes
      5 minute offered rate 3351000 bps
      Match: access-group name A5

    Class-map: A6and7-class (match-all)
      627615840 packets, 77824340228 bytes
      5 minute offered rate 9215000 bps
      Match: access-group name A6and7

    Class-map: A3-class (match-all)
      111548288 packets, 13831987712 bytes
      5 minute offered rate 1675000 bps
      Match: access-group name A3

    Class-map: A4andsource (match-all)
      16115590 packets, 1998333160 bytes
      5 minute offered rate 2513000 bps
      Match: access-group name A4
      Match: access-group name source

    Class-map: class-default (match-any)
      164881212 packets, 20445270288 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any 

Router# show ip access-lists

Extended IP access list A1
    10 permit ip 32.1.1.0 0.0.0.255 any (129580275 matches)
Extended IP access list A2
    10 permit ip 32.1.2.0 0.0.0.255 any (486342300 matches)
Extended IP access list A3
    10 permit ip 32.1.3.0 0.0.0.255 any (306738457 matches)
Extended IP access list A4
    10 permit ip 32.1.4.0 0.0.0.255 any (16147975 matches)
Extended IP access list A5
    10 permit ip 32.1.5.0 0.0.0.255 any (294357455 matches)
Extended IP access list A6and7
    10 permit ip 32.1.6.0 0.0.0.255 any (341426749 matches)
    20 permit ip 32.1.7.0 0.0.0.255 any (398245767 matches)
Extended IP access list source
    10 permit ip any host 16.1.1.5 (16147976 matches)

To confirm that the QoS: Packet Matching Statistics feature is enabled, use the show platform hardware qfp active feature qos config global command. If the feature is disabled, you should see a message similar to the following:

Router# show platform hardware qfp active feature qos config global

Marker statistics are: enabled
Match per filter statistics are: enabled