What Is Using Our Bandwidth

Unanswered Question
Sep 8th, 2009
User Badges:

Hi We monitor using SolarWinds the network bandwidth of our network we have noticed over the past week or so that it looks like someone is transfer data from one of our sites to another (the bandwith at both of this sites shoots up to like 80%, while all other sites run at like 20%).


Anyway we have Cisco 1841 router and what to know if there is anyway we can tell by running a Cisco command which devices (or IPs) on our network could be generating the most traffic.


Thanks

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Richard Burts Tue, 09/08/2009 - 03:52
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Andrew


There are a couple of options that you might consider. You could enable IP accounting on one or both of the routers and check the results that it generates to identify what is using that bandwidth.


The feature that I would really recommend is to enable NetFlow on the routers. NetFlow generates records that tell source and destination and type of traffic and volume of traffic. You can manually check the NetFlow records on the router but the best thing to do is to send the NetFlow records to a PC running an application to examine the NetFlow records and generate reporting. Solar Winds has a tool to process NetFlow and I think you would find it useful.


HTH


Rick

ralphcarter Tue, 09/08/2009 - 04:32
User Badges:

You can also enable "ip nbar protocol-discovery" on the external interfaces and see what types of traffic. This is great feature to find out if the network is using P2P file sharing, etc.

nsn-amagruder Tue, 09/08/2009 - 07:21
User Badges:

Both IP Account and NBAR are good solutions. You can also enable top-talkers with netflow to see the top 3 talkers on the link without exporting to netflow. Solarwinds does have a decent Netflow product that integrates with Orion and a free desktop version.


ip cef

!

interface s0/0/0

ip route-cache flow

ip flow ingress

ip flow egress

!

interface f0/0

ip route-cache flow

ip flow ingress

ip flow egress

!

ip flow-export destination x.x.x.x 9991

ip flow-export source f0/0

ip flow-export version 5


snmp-server ifindex persist


http://www.cisco.com/en/US/docs/ios/netflow/configuration/guide/cfg_nflow_top_talk.html


Actions

This Discussion