Does anyone know someway to see in the router wich IP address is generating more traffic?
With nbar I can see wich protocol is loading the link but not the IP who is doing this.
I would like to know if I can do that with only the router cli, with no external server.
You can use Netflow for the ingress or IP accounting for checking egress
ip flow ingress
show ip cache flow
show ip accounting
you can make use of netflow to check the same.
you need to enable ip route-cache flow under the ethernet interface and can check the traffic pattern using show ip cache flow command.
The output will give u a clear idea about the source/destination port/ip address packet counts to identify the utilization pattern.