[c-nsp] Netflow Top Talkers?

[Peter Rathlev]

IP accounting doesn't count MLS switched traffic on a Cat6500, so you
might not get a very good picture of what traffic passes through. I have
no idea how FlexWAN modules work, so it might not be an issue.

Netflow is probably the only thing that will give you the right picture
in all cases. And it's worth having in a lot of other debugging
situations.

Regads,
Peter

On Tue, 2008-03-18 at 11:19 +1030, Ben Steele wrote:
> try ip accounting on your interface, it won't impact your cpu much on  
> a T1 link and will give you you top "IP" talkers, you probably want to  
> append the output packets option to it to see who is downloading the  
> most, a "sh ip accounting" will give you a list of IP's and byte  
> counts for that interface.
> 
> Ben
> 
> On 18/03/2008, at 4:24 AM, Brandon Price wrote:
> 
> > I have a pretty simple requirement:
> >
> > Customer calls up and complains that their link (T1) is slow,
> > I take a quick look at MRTG for their link and see that it is at >95%
> > utilization.
> >
> > I would like a quick way see what traffic is saturating the link.
> >
> > It seems that Netflow Top talkers is what I want. I think.
> >
> > Unfortunatly none of the top-talkers commands are available on our  
> > main
> > router which is a Catalyst 6513 (Sup7203B) running Version  
> > 12.2(18)SXF12
> >
> > Cisco feature navigator says that top-talkers is available on
> > 12.2(33)SXH1.
> > Unfortunatly all of our T1 customers connect in via PA-MC-T3 cards in
> > NON ENHANCED FlexWAN modules and I believe that support for the NON
> > ENHANCED FlexWAN has been dropped in 12.2(33).
> >
> > Is there any other way to accomplish the same thing?
> >
> > I tried downloading the Solarwinds Realtime Netflow viewer, and
> > configuring exports, but
> > For some reason I wasn't seeing all of the flows. It appeared that I
> > would only see the flows that
> > Were new since I started the capture, preexisting flows werent showing
> > up.
> >
> > I am a complete novice regarding Netflow so any advice would be  
> > greatly
> > appreciated.
> >
> > Brandon Price
> > Sterling Communications Inc.
> >
> > /31 <--- The Subnet Formally Known as "Unusable"
> >
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/