urgent need show high banwidth user on switch?

Unanswered Question
Sep 28th, 2007
User Badges:

How can I tell who is using the most bandwidth on a switchport?

I have CiscoWorks, but need to trace a high user on a switchport with CiscoWorks or command line.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.8 (4 ratings)
glen.grant Fri, 09/28/2007 - 08:43
User Badges:
  • Purple, 4500 points or more

"show interface " will show the given load and how many packets per second.

vijayasankar Sun, 09/30/2007 - 21:57
User Badges:
  • Silver, 250 points or more


If the port involved is a layer 3 port, then you can turn on "ip accounting" under that interface and issue the command "show ip accounting" to see per user traffic statistics on that port.

If the port involved is a pure layer 2 switch port, then it will not be possible to directly get such statistics via CLI.

However you can configure a SPAN session to examine it, using a sniffer/ethereal tool running on machine connected to SPAN destination port. With the sniffer/ethereal capture, you can have the full statistics information.

Hope this helps.


wilson_1234_2 Mon, 10/01/2007 - 04:40
User Badges:

Thanks for the reply.

We found out what was causing the trouble, but:

Are you talking about a VLAN SVI for the layer 3 port?

Also, what if this were a Multilink bundle?

I would be able to see traffic staticstics for per user stats?

And if I turn this on, what sort of impact will this have on cpu or memory on that device?

vijayasankar Mon, 10/01/2007 - 05:06
User Badges:
  • Silver, 250 points or more


You can turn on the ip accounting under any interface( physical, vlan svi etc) which has an ip address.

Yes you can very well turn that feature under a multilink bundle interface. You would get the traffic statistics and from that you can find out, which ip is pumping more traffic.

IP accounting will result in additional CPU utilisation. However it shouldn't be causing any huge performance impact, unless you are already running at very high cpu utilisation.

As this is only for diagnostic purpose, once your troubleshooting is over, you would have to turn this feature off.

If you want to have such statistics collected and stored for future reference, you should look at the netflow feature, which provides much more details on traffic statistics. Ofcourse for this, you need a netflow collector software to interpret the netflow data exported from the switch and present it in a graph format and to archive the statistics for future reference.

Hope this helps.



This Discussion