rmon to detect traffic

Unanswered Question
May 14th, 2008


we have 6500 running IOS 12.2(18)SXF13. theres a sudden increase in CPU. IP input process use it. we suspect theres some bursty traffic causing it. theres no netflow enabled on it. want to use RMON to see the traffic.

not sure abut configuration.how do it. confused mainly with MIBS


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3 (1 ratings)
Joe Clarke Wed, 05/14/2008 - 12:17

What exactly do you want to do with RMON? Do you want to create an alert that is triggered when a threshold is violated, or do you want to setup etherstats to monitor the traffic rate?

followurself Thu, 05/15/2008 - 01:45


Thanks for the response

i want to monitor the stats received on our core interfaces.Also monitor the communication between source and destination and their traffic. then create baseline and get alerted if theres is sudden increase in the traffic, retransmission of packets, interface errors etc etc.

what kind of configuration is required on the switch. i am also not sure how to use and configure MIBS for the same.


Joe Clarke Thu, 05/15/2008 - 18:41

See http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_44_se/configuration/guide/swrmon.html . This document is for the 3750, but the commands are the same. You'll want to configure rmon collection stats on the ports. Then you can poll those stats using the etherStatsTable from the RMON-MIB. You will use the index number you specify in the config when doing the polling.

followurself Wed, 05/28/2008 - 00:41


Thanks for the reply. i am quite new to snmp.

we have many vlans on this switch. the cpu on the switch goes high to 95 percent. its because of ip input process. we think there's some increase in traffic from a certain source to destination. i understand we can get this info using RMON. can you please give me the exact commands to use.



This Discussion