Bandwidth consumption

Unanswered Question
Mar 21st, 2007

Hi All,

How can I know how much bandwidth is consumed by each station on my LAN? I familiar with methods such as NBAR, NetFlow and IP Accounting but none of them provide that particular information. NBAR tells me what applications are running, NetFlow show me which IP is trying to connect to which IP and how many bytes was sent and IP Accounting shows similar information to NetFlow.

But, when some station on my LAN flooding the connection, NBAR is recognizing that somebody is using p2p on the LAN how can I find out which station is actually doing this? I guess that all that comes down to the question how much bandwidth is consumed by each station (hopefully ? station + protocol) but what tool can tell me that?

p.s. btw, if there is some 3-rd party tool (i.e. not performed by Cisco router) that can answer that question I?d like to know about it too ? software or hardware based.

Thanks in advance,


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.5 (2 ratings)

If you are using a Netflow analyzer/application then Netflow will tell you how much bandwidth is being consumed by a particular flow, by IP address or by application. The only thing is it is historical and not real time. If you are interested in bandwidth being consumed at the switchport you could use an snmp tool like Orion.

m.matteson Fri, 03/23/2007 - 10:17

you could SNMP the octet counter for each switch port and just create a spreadsheet showing what stations are connected to what ports.

etherpeek by wildpackets is a good tool

amk_gremlin Mon, 04/02/2007 - 00:42

First of all,

I'd like to thank to all the people who participated in this topic (at least viewed the question). Now, some of the suggestions provided here were very-very helpful. But, when your network is suffers from traffic anomalies is this more an art than exact science to find out what's going on? I guess that any LAN/WAN Manager of middle size and above network ran into such a problem in some part of his life - maybe virus outbreak, some route-map that doesn't work as expected maybe some p2p on the LAN - how you solved it guys? Any additional information may be very helpful.

Again, every tool that provides IP + Protocol statistic would be very-very helpful.

Thanks in advance,



This Discussion