LAN Traffic

Unanswered Question
Oct 9th, 2007
User Badges:

Hi All

how do i check which ip address is generating more traffic on my network, i have cisco 2800 of router.

let me know if there is any utility available as i dont have any third party too running on my network.

- Dhaval Tandel

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3 (1 ratings)
Jon Marshall Tue, 10/09/2007 - 02:22
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Hi Dhaval

You can use ip accounting if you just want to see source and destination IP addresses and number of packets/bytes.

Attached is a link for configuring ip accounting. Please take note of the but at the end about possible performance degradation, it is not something you want to be running all the time.

To view the output

router# sh ip accounting



guruprasadr Tue, 10/09/2007 - 02:50
User Badges:
  • Gold, 750 points or more

HI Dhaval,

Jon is correct.

#show ip accounting

will provide the Source IP, Destination IP, Packets Transferred, Bytes Transferred Details.

Permanently enabling the ip accouting feature on CISCO Equipment will increase the CPU Load of the Device


Best Regards,

Guru Prasad R

Jon Marshall Tue, 10/09/2007 - 02:56
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN


No it is not enabled by default. You will need to turn it on and when you have found what you need turn it off again.


csc010854800 Wed, 10/10/2007 - 00:43
User Badges:


You can enable on a per interface basis.

go to that interface

#ip accounting output-packets

#show ip accouting

a.hajhamad Wed, 10/10/2007 - 02:04
User Badges:
  • Bronze, 100 points or more

In addition to what is mentioned above, you can also use "show ip cache flow", this command will show you source and destination IP address with source and destination ports "in hexadecimal". This show command is very helpful since it is automatically updated but the show ip accounting is not updated or refreshed. YOU NEED to do clear ip accounting since the data is incremental from last clear ip accounting.

Please note, if you like to do "show ip cache flow" you need to enable the following command at the interface mode

"ip route-cache flow"

You can forward this ip cache flow information to web based monitor application like NetFlow Analyzer 4. This tool is very helpful.

Abd Alqader


This Discussion