rmon to detect traffic

followurself · ‎05-14-2008

hi,

we have 6500 running IOS 12.2(18)SXF13. theres a sudden increase in CPU. IP input process use it. we suspect theres some bursty traffic causing it. theres no netflow enabled on it. want to use RMON to see the traffic.

not sure abut configuration.how do it. confused mainly with MIBS

thanks

Joe Clarke · ‎05-14-2008

What exactly do you want to do with RMON? Do you want to create an alert that is triggered when a threshold is violated, or do you want to setup etherstats to monitor the traffic rate?

followurself · ‎05-15-2008

Hi,

Thanks for the response

i want to monitor the stats received on our core interfaces.Also monitor the communication between source and destination and their traffic. then create baseline and get alerted if theres is sudden increase in the traffic, retransmission of packets, interface errors etc etc.

what kind of configuration is required on the switch. i am also not sure how to use and configure MIBS for the same.

thanks

Joe Clarke · ‎05-15-2008

See http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_44_se/configuration/guide/swrmon.html . This document is for the 3750, but the commands are the same. You'll want to configure rmon collection stats on the ports. Then you can poll those stats using the etherStatsTable from the RMON-MIB. You will use the index number you specify in the config when doing the polling.

followurself · ‎05-28-2008

Hi,

Thanks for the reply. i am quite new to snmp.

we have many vlans on this switch. the cpu on the switch goes high to 95 percent. its because of ip input process. we think there's some increase in traffic from a certain source to destination. i understand we can get this info using RMON. can you please give me the exact commands to use.

Thanks