[nsp] Suggestions on tracking down bandwidth offenders

[Raymond, Steven]

> to figure out who the big talkers were, but frankly it takes 
> too long to 
> crunch all the packets.  I've also tried etherApe, but the analysis 
> makes my poor little laptop crawl.  Are there any tools out 
> there that 
> will speed this up?  Possibly by looking at the firewall logs?

Have you tried 'ip accounting output-packets' on your LAN interface(s)?

To narrow the output down, it then helps to do something like this:

sh ip accounting | e (_[0-9]_|_[0-9][0-9]_)

Which means "exclude any lines 1 or 2 digit numbers surrounded by spaces".
Add more [0-9] to look at only the larger talkers.

It's quick & dirty, but easy.

HTH