Solved: Top traffic to/from?

skingry · ‎04-18-2007

I have a 3845 router that has a couple of interfaces generating a much larger amount of traffic than they should be. Is there a way to get a list of the IPs or MAC addresses, and how many octets they send/receive? The only way I've figured so far would be to create an access list permitting every IP address on the local networks (to and from) and then watching those counters...not a real good solution. ;-)

Thanks!

walleyewiz · ‎04-18-2007

You could enable netflow on the 3845. Below is a link to some free netflow collectors:

http://www.networkuptime.com/tools/netflow/

Configuring Netflow:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/switch_c/xcprt3/xcdnfc.htm

HTH.

View solution in original post

Iain · ‎04-19-2007

You need to consider implementing some sort of NetFlow collector system. We use NetFlow Tracker (recently acquired by Fluke). The way it works is you configure your router to export its netflow data to the server that is running the collector software. The software is able to present the data in a meaningful way.

http://www.crannog-software.com/index.php?go=Product.ShowDetail&ProductID=1

CiscoWorks can do this as well. However, we found that NetFlow tracker had more features at a lower cost. Runs on Windows and Linux.

If you can't afford the software, download an IOS image that has the "Netflow Top Talkers" feature. This will allow you to display some of the stats directly in the CLI.