[c-nsp] Netflow Top Talkers?

[Ben Steele]

There is no doubt what-so-ever that netflow is far superior(and more  
resource hungry) to ip accounting, but based on his scenario of  
customer A calls up randomly saying hey why is my link being saturated  
and they want a quick answer over the phone then turning ip accounting  
on for a minute can give you a quick(yet brief) view of what host is  
more than likely the culprit, generally enough info to give the  
customer who can then go back and yell at person with IP x.x.x.x (of  
course useless if it is all PAT'd)

Ben

On 18/03/2008, at 7:05 PM, Peter Rathlev wrote:

> IP accounting doesn't count MLS switched traffic on a Cat6500, so you
> might not get a very good picture of what traffic passes through. I  
> have
> no idea how FlexWAN modules work, so it might not be an issue.
>
> Netflow is probably the only thing that will give you the right  
> picture
> in all cases. And it's worth having in a lot of other debugging
> situations.
>
> Regads,
> Peter
>
> On Tue, 2008-03-18 at 11:19 +1030, Ben Steele wrote:
>> try ip accounting on your interface, it won't impact your cpu much on
>> a T1 link and will give you you top "IP" talkers, you probably want  
>> to
>> append the output packets option to it to see who is downloading the
>> most, a "sh ip accounting" will give you a list of IP's and byte
>> counts for that interface.
>>
>> Ben
>>
>> On 18/03/2008, at 4:24 AM, Brandon Price wrote:
>>
>>> I have a pretty simple requirement:
>>>
>>> Customer calls up and complains that their link (T1) is slow,
>>> I take a quick look at MRTG for their link and see that it is at  
>>> >95%
>>> utilization.
>>>
>>> I would like a quick way see what traffic is saturating the link.
>>>
>>> It seems that Netflow Top talkers is what I want. I think.
>>>
>>> Unfortunatly none of the top-talkers commands are available on our
>>> main
>>> router which is a Catalyst 6513 (Sup7203B) running Version
>>> 12.2(18)SXF12
>>>
>>> Cisco feature navigator says that top-talkers is available on
>>> 12.2(33)SXH1.
>>> Unfortunatly all of our T1 customers connect in via PA-MC-T3 cards  
>>> in
>>> NON ENHANCED FlexWAN modules and I believe that support for the NON
>>> ENHANCED FlexWAN has been dropped in 12.2(33).
>>>
>>> Is there any other way to accomplish the same thing?
>>>
>>> I tried downloading the Solarwinds Realtime Netflow viewer, and
>>> configuring exports, but
>>> For some reason I wasn't seeing all of the flows. It appeared that I
>>> would only see the flows that
>>> Were new since I started the capture, preexisting flows werent  
>>> showing
>>> up.
>>>
>>> I am a complete novice regarding Netflow so any advice would be
>>> greatly
>>> appreciated.
>>>
>>> Brandon Price
>>> Sterling Communications Inc.
>>>
>>> /31 <--- The Subnet Formally Known as "Unusable"
>>>
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/