[c-nsp] Netflow Top Talkers?

[Colin McNamara]

Netflow for novices = ntop with the netflow plugin activated.

It is free, and runs natively on Linux. You can get it here -
You can get it here - http://www.ntop.org/overview.html

If Linux is not your thing, then OpenXTRA repackages it in a windows 
executable that will also get the job done.
http://www.openxtra.co.uk/freestuff/ntop-xtra.php

How to configure the netflow plugin once you have it installed
http://www.ntop.org/netflow.html

Change the local network statement in NTOP to their subnet, and you 
should get a really quick view of not only who is the offenders, but 
also the types of traffic they are pushing.
Of course, there are much better tools for a permanent scalable 
installation. But this should solve your immediate problem, and 
hopefully get you started in the right direction for scalable long term 
netflow monitoring.

-- 
Colin McNamara
(858)208-8105
CCIE #18233,RHCE,GCIH 
http://www.colinmcnamara.com
http://www.linkedin.com/in/colinmcnamara

"The difficult we do immediately, the impossible just takes a little longer"


Brandon Price wrote:
> I have a pretty simple requirement:
>
> Customer calls up and complains that their link (T1) is slow,
> I take a quick look at MRTG for their link and see that it is at >95%
> utilization.
>
> I would like a quick way see what traffic is saturating the link.
>
> It seems that Netflow Top talkers is what I want. I think.
>
> Unfortunatly none of the top-talkers commands are available on our main
> router which is a Catalyst 6513 (Sup7203B) running Version 12.2(18)SXF12
>
> Cisco feature navigator says that top-talkers is available on
> 12.2(33)SXH1.
> Unfortunatly all of our T1 customers connect in via PA-MC-T3 cards in
> NON ENHANCED FlexWAN modules and I believe that support for the NON
> ENHANCED FlexWAN has been dropped in 12.2(33).
>
> Is there any other way to accomplish the same thing?
>
> I tried downloading the Solarwinds Realtime Netflow viewer, and
> configuring exports, but
> For some reason I wasn't seeing all of the flows. It appeared that I
> would only see the flows that
> Were new since I started the capture, preexisting flows werent showing
> up.
>
> I am a complete novice regarding Netflow so any advice would be greatly
> appreciated.
>
> Brandon Price
> Sterling Communications Inc.
>  
> /31 <--- The Subnet Formally Known as "Unusable"
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>