Cisco Performance Monitor

Hello Mirko

The difference between the match and collect keywords in the context of CPM is a little bit nuanced and needs further explanation.

The match keyword is used to define criteria for classifying network traffic. When configuring a class map, the match statements specify the conditions that packets must meet to be considered part of the class. In the context of CPM, they define the flow, as you suggest in your post.

The collect keyword, on the other hand, is used for gathering statistics or metrics about the traffic that has been matched and classified into this flow. When you use the collect command, it enables the monitoring and recording of specific information about the traffic that has been matched using the match keyword.

There is another distinction between match and collect that is especially useful: Match criteria are considered key fields while collect parameters are considered nonkey fields.

A key field is a parameter or attribute used to categorize or classify network traffic. Examples of key fields include source and destination IP addresses, port numbers, protocol types, and more. These fields are used in match statements in class maps to define the criteria for traffic classification.

Nonkey fields, on the other hand, are additional data points that provide further information about the traffic but are not used for classifying the traffic into different classes. When you use the collect command, you can specify which nonkey fields to gather data on. These might include things like:

  • Packet lengths
  • Time stamps (to calculate flow duration)
  • TCP flags
  • Packet counts
  • Byte counts
  • Other flow-specific details that are not used for classification but are useful for monitoring and analysis purposes

So flows are defined using the match statement, and the information that is monitored about that flow is specified using the collect statement.

I hope this has been helpful!