[c-nsp] Netflow Top Talkers?

[Brandon Price]

Ip accounting was my preferred method when we were using 7206s

Now on the 6500 I get the following output:

Router(config)#int serial1/0/0/1:0
Router(config-if)#ip accounting output-packets 
Accounting will exclude mls traffic when mls is enabled.

Router(config-if)# 

So Netflow it is then.

A few folks pointed this out and I think they are correct that the issue
is the Cache aging for active flows.

What I don't know is what are the negative impacts of setting a really
short timeout for active flows?

Our router Catalyst has about 150 T1s and 2 DS3s of DSL with lots of
VOIP..
The output of show proc is:

CPU utilization for five seconds: 2%/1%; one minute: 2%; five minutes:
2%

Can I safely crank down the aging timer? What is a good value?


Brandon Price
Sterling Communications Inc.
 
/31 <--- The Subnet Formally Known as "Unusable"





-----Original Message-----
From: Ben Steele [mailto:ben at internode.com.au] 
Sent: Monday, March 17, 2008 5:50 PM
To: Brandon Price
Cc: Cisco-nsp
Subject: Re: [c-nsp] Netflow Top Talkers?

try ip accounting on your interface, it won't impact your cpu much on a
T1 link and will give you you top "IP" talkers, you probably want to
append the output packets option to it to see who is downloading the
most, a "sh ip accounting" will give you a list of IP's and byte counts
for that interface.

Ben

On 18/03/2008, at 4:24 AM, Brandon Price wrote:

> I have a pretty simple requirement:
>
> Customer calls up and complains that their link (T1) is slow, I take a

> quick look at MRTG for their link and see that it is at >95% 
> utilization.
>
> I would like a quick way see what traffic is saturating the link.
>
> It seems that Netflow Top talkers is what I want. I think.
>
> Unfortunatly none of the top-talkers commands are available on our 
> main router which is a Catalyst 6513 (Sup7203B) running Version
> 12.2(18)SXF12
>
> Cisco feature navigator says that top-talkers is available on 
> 12.2(33)SXH1.
> Unfortunatly all of our T1 customers connect in via PA-MC-T3 cards in 
> NON ENHANCED FlexWAN modules and I believe that support for the NON 
> ENHANCED FlexWAN has been dropped in 12.2(33).
>
> Is there any other way to accomplish the same thing?
>
> I tried downloading the Solarwinds Realtime Netflow viewer, and 
> configuring exports, but For some reason I wasn't seeing all of the 
> flows. It appeared that I would only see the flows that Were new since

> I started the capture, preexisting flows werent showing up.
>
> I am a complete novice regarding Netflow so any advice would be 
> greatly appreciated.
>
> Brandon Price
> Sterling Communications Inc.
>
> /31 <--- The Subnet Formally Known as "Unusable"
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/