[nsp] Suggestions on tracking down bandwidth offenders

[Tony Mucker]

Thanks for all the great suggestions.  We finally tracked it down 
yesterday afternoon (after a day and a half of hammering the T1).

It was a little router that sat in front of a legacy engineering/demo 
network of about 12 machines.  I've only been here 2 months, and had 
forgotten about.  The router is configured so that it passes traffic 
straight to the router, bypassing the firewall (even though it has an 
interface on the inside of the firewall, go figure).  So I spent most of 
the day looking at the wrong MRTG graphs.

I'm currently building up a linux machine to run ntop on.  I've heard 
about it before, never had a reason to try it.

In my budget I've got room for more than a few tools.  Has anyone had 
any experience with Shomiti Surveyor?  I've got an older copy here (3.2) 
and was wondering if it's worth my while to renew it. 

Finally, I've also got it in my budget to get more sophisticated that 
will allow me more QoS options.  Right now the core switch is a Cat4006, 
with a Sup2 and a Layer 3 Services module.  The only QoS I can do is on 
the GBIC ports on the Layer 3 module, and that's only if the ports are 
running layer 3.  So I'm looking at upgrading it to a Sup4, or possibly 
doing something else with the money.  The device by Packeteer looks 
interesting (I Saw it on this mailing list earlier and talked to someone 
last night who was using it).  Any ideas?

Thanks much
Tony