[nsp] Suggestions on tracking down bandwidth offenders

[Hank Nussbacher]

At 10:44 AM 14-07-04 -0700, Michael Axelrod wrote:

And that your router is *not* doing DCEF otherwise the 'sho ip cache flow' 
data will just be flows the RSP is seeing.

-Hank

>I use netflow for a quick look at the top traffic consumers.
>Statistics can be cleared  - "clear ip flow stats" - and you can view the
>stats flow by flow.
>Just need to make sure that netflow is on the egress and ingress interfaces
>to get bi-directional traffic stats.
>
>Mike
>----- Original Message -----
>From: "Tony Mucker" <Tony at tonymucker.com>
>To: <cisco-nsp at puck.nether.net>
>Sent: Wednesday, July 14, 2004 10:24 AM
>Subject: [nsp] Suggestions on tracking down bandwidth offenders
>
>
> > I've got a bandwidth problem (who doesn't).  Something has been
> > saturating my poor little T1 for 24 hours straight now.  For those of
> > you curious, here's what it looks like:
> >
> > http://www .ghideon.com/router-day.png
> >
> > Remove the white space and enjoy.  In the past I've used ethereal dumps
> > to figure out who the big talkers were, but frankly it takes too long to
> > crunch all the packets.  I've also tried etherApe, but the analysis
> > makes my poor little laptop crawl.  Are there any tools out there that
> > will speed this up?  Possibly by looking at the firewall logs?
> >
> > Thanks
> > Tony
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/