[nsp] Finding the bandwidth hogs

[Oliver Boehmer (oboehmer)]

Hi Christopher,

> 	I'm trying to find an easy(er) way to find the local users
hogging a
> T1 line.  I've used netflow with ntop and ip accounting.  Both of
> those were time consuming and the results were hit and miss.  The
> problem is too many source<->destination pairs.  I really don't care
> about the remote location, only the local one.   Any ideas?

Use netflow aggregation (aka NetFlow version 8) and use an aggregation
scheme like "source-prefix". This will aggregate all flows from a given
source prefix into a single v8 flow record. Please note that the
aggregation works on the RIB/FIB, so traffic from a directly connected
/24 ethernet would end up in one /24 record. If you still need finer
granularity, you can use the "minimum mask" feature. 

You want to check out the following docs:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft
/120t/120t3/netflow.htm
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft
/121t/121t2/dtnfmask.htm
http://www.cisco.com/univercd/cc/td/doc/cisintwk/intsolns/netflsol/nfwhi
te.htm

	oli