[c-nsp] Tracking bandwidth hogs ... any recommendations ?

[William F. Maton Sotomayor]

On Thu, 26 Mar 2009, Paul Stewart wrote:

> Netflow would be our first choice if possible...

+1

Definitely NetFlow.  In a pinch, one could do 'show ip ca fl' over and 
over a few times to try and eyeball quickly rising counters, then isolate 
the interesting line by doing 'show ip ca fl | inc <an IP address>' to 
verify the type of traffic, etc for that IP.

For something longer-term OSU/Google code flow-tools is a good option.


> Paul
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Wilkinson, Alex
> Sent: Thursday, March 26, 2009 8:16 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Tracking bandwidth hogs ... any recommendations ?
>
> Hi all,
>
> I would like to put in place measures to be able to pin point the particular
> user(s) who are thrashing out our WAN connection. I am thinking ...
>
>  Mirror all ports (SPAN) to a spare port and use trafshow to pinpoint the
> culprit.
>
> However, i am curious how others deal with this situation ?
>
> -aW
>
> IMPORTANT: This email remains the property of the Australian Defence
> Organisation and is subject to the jurisdiction of section 70 of the CRIMES
> ACT 1914.  If you have received this email in error, you are requested to
> contact the sender and delete the email.
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
>
> This message was delivered by MDaemon - http://www.altn.com/MDaemon/
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>


wfms