That's kind of what I thought but how do I find that out? I am using Orion NPM but that doesn't tell me much. Would a sniffer be able to tell me what the actual packets are?

hi,

IPSEC traffic in encrypted and GRE is encapsulated as we know.

so you may enable the cache flow in inside interface(may be fastethernet- im just gussing as i dont know your network).

Or you must be aware of the intresting traffic defined for IPSEC whihc passes throgh GRE tunnel , where you can ground the source.

A detailed Stdy on ip accounting and Ip cache flow whould probably help you to figureout the same.

Juan

You were looking at NetFlow running on the outside interface when you saw that the traffic was GRE and IPSec. I agree with Rajeev that if you run NetFlow on the inside interface(es) you will probably see what traffic is increasing and causing the spike.

HTH

Rick

NTA shows high bandwidth utilization because the tunnel its self as far as bandwidth is doing 8kbps or 10kbps... if you show your stats with show interfaces tun 0 you can see that the interfa e has a high utilization of 193/255. A bandwidth statement is needed there but I'm not what to put if the physical bandwidth or the actual circuit bandwidth   it gets tricky when running two up links with different bandwidth... but that's your answer if you set a different value and no problems please share