match

Function

The match command configures the aggregation keywords of a flexible flow statistics template.

The undo match command deletes the aggregation keywords of the flexible flow statistics template.

By default, no aggregation keyword is configured for the flexible flow statistics template.

Format

match { source | destination } { vlan | as | port | address | mask }

match mpls top-label ip-address

match mpls label position

match { protocol | tos | direction | tcp-flag }

match { input | output } interface

match next-hop [ bgp ]

undo match { source | destination } { vlan | as | port | address | mask }

undo match mpls top-label ip-address

undo match mpls label position

undo match { protocol | tos | direction | tcp-flag }

undo match { input | output } interface

undo match next-hop [ bgp ]

Parameters

Parameter	Description	Value
source	Indicates aggregation based on the source end.	-
destination	Indicates aggregation based on the destination end.	-
vlan	Indicates aggregation based on the VLAN.	-
as	Indicates aggregation based on the autonomous system (AS).	-
port	Indicates aggregation based on the port number.	-
address	Indicates aggregation prefix-based on the address.	-
mask	Indicates aggregation based on the mask.	-
mpls	Indicates the multi-protocol label switching.	-
top-label	Indicates the top label.	-
ip-address	Specifies the IP address.	-
label position	Specifies the MPLS label location based on which aggregation is performed.	The value is an integer ranging from 1 to 3.
protocol	Indicates aggregation based on the protocol type.	-
tos	Indicates aggregation based on the ToS priority.	-
direction	Indicates aggregation based on the flow direction.	-
tcp-flag	Indicates aggregation based on the tcp-flag.	-
input	Indicates aggregation based on the ingress port.	-
output	Indicates aggregation based on the egress port.	-
interface	Specifies the interface.	-
next-hop	Indicates aggregation based on the next hop.	-
bgp	Indicates aggregation based on the BGP protocol.	-

Views

NetStream IPv6 record view., NetStream record view

Default Level

3: Management level

Task Name and Operations

Task Name	Operations
netstream	write

Usage Guidelines

Usage Scenario

NetStream supports 17 aggregation modes. For each aggregation mode, original flows are classified and combined to generate aggregated flow information and are aged and exported to the server based on fixed rules. Flexible customization is not supported. Flexible flow packets provide a user-defined template for users to customize matching fields as required. The user-defined template improves traffic analysis accuracy and reduces network bandwidth occupation, CPU usage, and storage space usage.

Prerequisites

Before you run the match command, run the ip netstream record or ipv6 netstream record command to create a flexible flow statistics template.

Precautions

If a flexible flow has been applied, you are not allowed to run the match command to modify the matching rules.

The maximum length that the flexible flow statistics template supports is 50 bytes, including the collect and match fields.

Lengths of the match fields:

address: 4 bytes for an IPv4 address and 16 bytes for an IPv6 address
mask: 1 byte
port: 2 bytes
vlan: 2 bytes
as: 4 bytes
mpls top-label ip-address: 4 bytes
mpls label 1: 3 bytes
mpls label 2: 3 bytes
mpls label 3: 3 bytes
potocol: 1 byte
tos: 1 byte
direction: 1 byte
tcp-flag: 1 byte
input interface: 4 bytes
output interface: 4 bytes
next-hop: 4 bytes for an IPv4 address and 16 bytes for an IPv6 address
bgp next-hop: 4 bytes for an IPv4 address and 16 bytes for an IPv6 address
Lengths of the collect fields:
first: 4 bytes
last: 4 bytes
packets: 4 bytes
bytes: 4 bytes
The match source address command indicates aggregation based on the source prefix address. It is the prefix address pool after the source IP address and source mask address are masked.
The match destination address command indicates aggregation based on the destination prefix address. It is the prefix address pool after the destination IP address and destination mask address of the traffic are masked.
If the obtained mask address is 0, no mask operation is performed. Aggregation is performed based on the IP address.

Example

# Configure matching rules in the flexible flow view.

<HUAWEI> system-view
[~HUAWEI] ip netstream record tt
[*HUAWEI-record-tt] match source address
[*HUAWEI-record-tt] match source port
[*HUAWEI-record-tt] match protocol
[*HUAWEI-record-tt] match tos
[*HUAWEI-record-tt] match direction