Re: [nsp] top ip talkers

From: Jared Mauch (jared@puck.nether.net)
Date: Sat Feb 23 2002 - 12:10:22 EST


        If you have ethernet interfaces, you can do:

 ip accounting mac-address input
 ip accounting mac-address output

        This will allow you to see stats like this:

  Input (498 free)
    0001.0330.476c(25 ): 4918 packets, 476501 bytes, last: 5094008ms ago
    0030.6515.0663(37 ): 69706 packets, 9271834 bytes, last: 4075608ms ago
    0020.af38.e872(45 ): 2620 packets, 289902 bytes, last: 5088ms ago
    0004.5a0e.7e01(47 ): 50 packets, 6154 bytes, last: 3717928ms ago
    0000.c04d.3d8f(63 ): 258 packets, 18058 bytes, last: 48202360ms ago
    0000.0c31.92ed(66 ): 16053 packets, 1211079 bytes, last: 25440ms ago
    0080.2d93.1160(79 ): 89 packets, 6167 bytes, last: 23266600ms ago
    0800.2082.51a7(92 ): 3343800 packets, 1919M bytes, last: 100ms ago
    0090.6994.1400(121): 1 packets, 78 bytes, last: 310160920ms ago
    00a0.2483.53d8(140): 5335393 packets, 1853M bytes, last: 0ms ago
    00a0.246d.1764(154): 916 packets, 139521 bytes, last: 26354080ms ago
    0005.02d8.7200(173): 569058 packets, 259727169 bytes, last: 317172ms ago
    0090.2735.86bb(191): 52518 packets, 7487451 bytes, last: 3908ms ago
    00b0.6405.1720(230): 9232 packets, 886986 bytes, last: 37372ms ago
                  Total: 9404612 packets, 4051M bytes
  Output (493 free)
    0001.0330.476c(25 ): 4878 packets, 1697970 bytes, last: 5075840ms ago
    0030.6515.0663(37 ): 90900 packets, 100138873 bytes, last: 67198424ms ago
    0020.af38.e872(45 ): 2622 packets, 220160 bytes, last: 5088ms ago
    0004.5a0e.7e01(47 ): 66 packets, 4080 bytes, last: 26353688ms ago
    0000.c04d.3d8f(63 ): 336 packets, 72256 bytes, last: 48202252ms ago
    0000.0c31.92ed(66 ): 15674 packets, 965066 bytes, last: 578980ms ago
    0080.2d93.1160(79 ): 91 packets, 5764 bytes, last: 23267372ms ago
    0100.5e00.000d(82 ): 10323 packets, 619380 bytes, last: 20428ms ago
    0100.5e00.0005(90 ): 32555 packets, 2826414 bytes, last: 9200ms ago
    0800.2082.51a7(92 ): 3189087 packets, 270451863 bytes, last: 4ms ago
    0100.5e00.0001(94 ): 5158 packets, 309480 bytes, last: 428ms ago
    0100.5e00.0128(118): 5205 packets, 322710 bytes, last: 45544ms ago
    0100.5e00.0127(121): 10339 packets, 641018 bytes, last: 22428ms ago
    00a0.2483.53d8(140): 4980824 packets, 556492344 bytes, last: 12ms ago
    00a0.246d.1764(154): 1472 packets, 125332 bytes, last: 26354832ms ago
    0005.02d8.7200(173): 354417 packets, 38795294 bytes, last: 317924ms ago
    0090.2735.86bb(191): 54076 packets, 33812308 bytes, last: 4408ms ago
    0100.5e02.7ffe(220): 1056 packets, 744880 bytes, last: 139441600ms ago
    00b0.6405.1720(230): 8192 packets, 728458 bytes, last: 38124ms ago
                  Total: 8767271 packets, 1008M bytes

        - Jared

On Sat, Feb 23, 2002 at 05:54:53PM +0100, Mark Pace Balzan wrote:
> Hi All,
>
> I know this may be slightly off topic, but can someone point me in the right
> direction for identifying the top talkers ip addresses on my network. I was
> looking at collecting netflow data off my cisco 7206
>
> Any other ideas from those that are already doing this are very welcome.
>
>
>
> Many thanks
>
>
>
> Mark

-- 
Jared Mauch  | pgp key available via finger from jared@puck.nether.net
clue++;      | http://puck.nether.net/~jared/  My statements are only mine.



This archive was generated by hypermail 2b29 : Sun Aug 04 2002 - 04:13:05 EDT