What Is Using Our Bandwidth

asmith1972 · ‎09-08-2009

Hi We monitor using SolarWinds the network bandwidth of our network we have noticed over the past week or so that it looks like someone is transfer data from one of our sites to another (the bandwith at both of this sites shoots up to like 80%, while all other sites run at like 20%).

Anyway we have Cisco 1841 router and what to know if there is anyway we can tell by running a Cisco command which devices (or IPs) on our network could be generating the most traffic.

Thanks

Richard Burts · ‎09-08-2009

Andrew

There are a couple of options that you might consider. You could enable IP accounting on one or both of the routers and check the results that it generates to identify what is using that bandwidth.

The feature that I would really recommend is to enable NetFlow on the routers. NetFlow generates records that tell source and destination and type of traffic and volume of traffic. You can manually check the NetFlow records on the router but the best thing to do is to send the NetFlow records to a PC running an application to examine the NetFlow records and generate reporting. Solar Winds has a tool to process NetFlow and I think you would find it useful.

HTH

Rick

HTH

Rick

ralphcarter · ‎09-08-2009

You can also enable "ip nbar protocol-discovery" on the external interfaces and see what types of traffic. This is great feature to find out if the network is using P2P file sharing, etc.

CCIE 26175
www.techsnips.com

nsn-amagruder · ‎09-08-2009

Both IP Account and NBAR are good solutions. You can also enable top-talkers with netflow to see the top 3 talkers on the link without exporting to netflow. Solarwinds does have a decent Netflow product that integrates with Orion and a free desktop version.

ip cef

!

interface s0/0/0

ip route-cache flow

ip flow ingress

ip flow egress

!

interface f0/0

ip route-cache flow

ip flow ingress

ip flow egress

!

ip flow-export destination x.x.x.x 9991

ip flow-export source f0/0

ip flow-export version 5

snmp-server ifindex persist

http://www.cisco.com/en/US/docs/ios/netflow/configuration/guide/cfg_nflow_top_talk.html