Display which user is using what (C3750)

Unanswered Question
Dec 6th, 2007
User Badges:


I was trying to check on a C3750 Router to see the traffic comming through this router.

My goal was to see which ip-address is using the most bandwidth and also which ports he/she is using.

We seem to have a downloader in our company and we want to know which computer is utilizing our bandwidth.

Anyone has an idea how to check for this?

Thanks in Advance.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jan Nejman Thu, 12/06/2007 - 02:13
User Badges:
  • Bronze, 100 points or more


the best for this issue is using a NetFlow. But NetFlow is not supported on your 3750. Do you have any other Cisco device, i.e. router for communication with your ISP?


Caligare, Co.


solferry1 Thu, 12/06/2007 - 02:34
User Badges:

Hi Jan,

We do have an ISP router for MPLS, but we don't have access to it unfortunately.

I tried to figure out some ip accounting statements, but it didn't got me what I want.

Maybe SNMP?

yjdabear Thu, 12/06/2007 - 11:15
User Badges:
  • Gold, 750 points or more

When NetFlow is not available, another albeit more costly option is to connect a RMON2 probe to the 3750 and span the traffic to that port.

solferry1 Fri, 12/07/2007 - 07:26
User Badges:

Thanks for the idea, at the moment we don't have any intention for hardware investments, and ofcoures I was just curious what the right way is for issues like these, there i can imagen I am not the only one dealing with users on the network trying to download and using bandwidth intensively.

I will continue my quest, and ofcourse update this topic when I have found an answer.


srego4 Fri, 12/07/2007 - 12:56
User Badges:

If you do not have any management software etc... get a free one ... mtrg or mrtg is a good one.

glen.grant Sat, 12/08/2007 - 18:35
User Badges:
  • Purple, 4500 points or more

On a moment to moment basis you can use the command " show controllers utilization " and this will show you the utilization for each and every port , if you see one using more than the others then just do a "show mac-address for the port then look in the arp table for the address and you have your user , but this is a manual process and the user would have to be doing something at the time in order to see it . This command is very useful though for looking at things and to see how busy the stack ring is if it is a 3750 stack. you can also clear counters then use the command "show interface counters and see who has tranferred the most amount of packets in the period since you cleared counters.

solferry1 Sun, 12/09/2007 - 04:42
User Badges:

Hope the counters will work, I think I can get along with the things you suggest, thanks very much!

I tried the IP Accounting, but it looks like this is disabled/not supported on the 3750, this controller utilization thing is going to do the job i guess.

Thanks very much!

Else the solution would be some kind of SMTP program to fetch the data.. also nice, but I like to be in control :).

davehedgehog Sun, 12/16/2007 - 08:24
User Badges:

Here's what I do. I can't remember the commands but i'll look them up if you need me to.

Say your WAN connection is on fa0/1 and your pc is on fa0/2. You can set the switch to send all the frames that would be destined to go out via fa0/1 to also go out via fa0/2.

When you think someone is abusing the WAN connection, just enable this command and run Ethereal on your PC to sniff exactly what is going out on the WAN connection.

will this do the trick?


This Discussion