show access-list hitcounts

Description

Shows the hit count of the number of times an ACL has matched a packet or frame for ACEs with the count keyword. For ACEs without the count keyword, a dash is shown in place of a hit count.

Command context

Operator (>) or Manager (#)

Parameters

[ip|ipv6|mac]

Specifies the ACL type: ip for IPv4, ipv6 for IPv6, or mac for MAC.

<ACL-NAME>

Specifies the ACL name.

[interface <IFNAME>]

Specifies the interface name (port or LAG).

[vlan <VLAN-ID>]

Specifies the VLAN.

[in|out]

Specifies the traffic direction. The out (egress) direction is not available for VLANs.

[vsx-peer]

Shows the output from the VSX peer switch. If the switches do not have the VSX configuration or the ISL is down, the output from the VSX peer switch is not displayed.

Authority

Operators or Administrators. Users without administrator authority can execute this command from the operator context (>) only.

Usage

• ACL hit counts are aggregated across all:

  • physical interfaces to which the ACL is applied to on ingress,

  • physical interfaces to which the ACL is applied to on egress,

  • VLANs to which the ACL is applied to on ingress.

• If an ACL with an ACE with the count keyword is applied to multiple physical interfaces or VLANs, the hit counts are aggregated. There is one aggregation for physical interfaces and another for VLANs.

• Accumulated hit counts for an applied ACL are cleared upon any modification of the ACL.

Examples

Displaying the hit counts for IPv4 port 1/1/1:

switch# show access-list hitcounts ip MY_ACL interface 1/1/1
Statistics for ACL MY_ACL (ipv4):
interface 1/1/1* (in):
           Hit Count  Configuration
                   -  10 permit udp any 172.16.1.0/255.255.255.0
                   -  20 permit tcp 172.16.2.0/255.255.0.0 gt 1023 any
                   -  30 permit tcp 172.26.1.0/255.255.255.0 any dscp AF11 ack syn
                   8  40 deny any any any count
* access-list statistics are shared among each combination of
  context type (interface, VLAN, VRF) and direction (in, out, control-plane).
  use 'access-list TYPE NAME copy' to create a uniquely-named access-list.

Displaying the hit counts for IPv4 VLAN 10:

switch# show access-list hitcounts ip My_ip_ACL vlan 10
Statistics for ACL My_ip_ACL (ipv4):
vlan 10* (in):
           Hit Count  Configuration
                   -  10 permit udp any 172.16.1.0/255.255.255.0
                   -  20 permit tcp 172.16.2.0/255.255.0.0 gt 1023 any
                   -  30 permit tcp 172.26.1.0/255.255.255.0 any dscp AF11 ack syn
                   5  40 deny any any any count
* access-list statistics are shared among each combination of
  context type (interface, VLAN, VRF) and direction (in, out, control-plane).
  use 'access-list TYPE NAME copy' to create a uniquely-named access-list.