[nsp] Suggestions on tracking down bandwidth offenders

[Hank Nussbacher]

At 11:09 AM 14-07-04 -0700, Michael Axelrod wrote:
>;-) true, with DCEF on you can run sh ip cache flow in each VIP ;-) using
>"attach" command. or in case of GSR "execute on"

Nope.  You need to get to each VIPn via:

enable
if-cons n
sho ip cache flow
if-quit

-Hank

>Right?
>Mike
>----- Original Message -----
>From: "Hank Nussbacher" <hank at mail.iucc.ac.il>
>To: "Michael Axelrod" <axelrod1 at comcast.net>; "Tony Mucker"
><Tony at tonymucker.com>; <cisco-nsp at puck.nether.net>
>Sent: Wednesday, July 14, 2004 12:01 PM
>Subject: Re: [nsp] Suggestions on tracking down bandwidth offenders
>
>
> > At 10:44 AM 14-07-04 -0700, Michael Axelrod wrote:
> >
> > And that your router is *not* doing DCEF otherwise the 'sho ip cache flow'
> > data will just be flows the RSP is seeing.
> >
> > -Hank
> >
> > >I use netflow for a quick look at the top traffic consumers.
> > >Statistics can be cleared  - "clear ip flow stats" - and you can view the
> > >stats flow by flow.
> > >Just need to make sure that netflow is on the egress and ingress
>interfaces
> > >to get bi-directional traffic stats.
> > >
> > >Mike
> > >----- Original Message -----
> > >From: "Tony Mucker" <Tony at tonymucker.com>
> > >To: <cisco-nsp at puck.nether.net>
> > >Sent: Wednesday, July 14, 2004 10:24 AM
> > >Subject: [nsp] Suggestions on tracking down bandwidth offenders
> > >
> > >
> > > > I've got a bandwidth problem (who doesn't).  Something has been
> > > > saturating my poor little T1 for 24 hours straight now.  For those of
> > > > you curious, here's what it looks like:
> > > >
> > > > http://www .ghideon.com/router-day.png
> > > >
> > > > Remove the white space and enjoy.  In the past I've used ethereal
>dumps
> > > > to figure out who the big talkers were, but frankly it takes too long
>to
> > > > crunch all the packets.  I've also tried etherApe, but the analysis
> > > > makes my poor little laptop crawl.  Are there any tools out there that
> > > > will speed this up?  Possibly by looking at the firewall logs?
> > > >
> > > > Thanks
> > > > Tony
> > > > _______________________________________________
> > > > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > > > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > > > archive at http://puck.nether.net/pipermail/cisco-nsp/
> > >
> > >_______________________________________________
> > >cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > >https://puck.nether.net/mailman/listinfo/cisco-nsp
> > >archive at http://puck.nether.net/pipermail/cisco-nsp/
> >