LAN Traffic

dhavaltandel · ‎10-09-2007

Hi All

how do i check which ip address is generating more traffic on my network, i have cisco 2800 of router.

let me know if there is any utility available as i dont have any third party too running on my network.

- Dhaval Tandel

Jon Marshall · ‎10-09-2007

Hi Dhaval

You can use ip accounting if you just want to see source and destination IP addresses and number of packets/bytes.

Attached is a link for configuring ip accounting. Please take note of the but at the end about possible performance degradation, it is not something you want to be running all the time.

To view the output

router# sh ip accounting

http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/products_command_reference_chapter09186a008017d169.html#wp1091971

HTH

Jon

guruprasadr · ‎10-09-2007

HI Dhaval,

Jon is correct.

#show ip accounting

will provide the Source IP, Destination IP, Packets Transferred, Bytes Transferred Details.

Permanently enabling the ip accouting feature on CISCO Equipment will increase the CPU Load of the Device

DO RATE ALL HELPFUL POSTS

Best Regards,

Guru Prasad R

dhavaltandel · ‎10-09-2007

Hello

i believe is not enabled by default.

- Dhaval Tandel

Jon Marshall · ‎10-09-2007

Dhaval

No it is not enabled by default. You will need to turn it on and when you have found what you need turn it off again.

Jon

csc010854800 · ‎10-10-2007

Hi,

You can enable on a per interface basis.

go to that interface

#ip accounting output-packets

#show ip accouting

a.hajhamad · ‎10-10-2007

In addition to what is mentioned above, you can also use "show ip cache flow", this command will show you source and destination IP address with source and destination ports "in hexadecimal". This show command is very helpful since it is automatically updated but the show ip accounting is not updated or refreshed. YOU NEED to do clear ip accounting since the data is incremental from last clear ip accounting.

Please note, if you like to do "show ip cache flow" you need to enable the following command at the interface mode

"ip route-cache flow"

You can forward this ip cache flow information to web based monitor application like NetFlow Analyzer 4. This tool is very helpful.

Abd Alqader