How to find the largest user in a Cisco Router

TRACKME_2 · ‎07-30-2010

Dear All,

I would like to know how to isolate in a cisco router which Source or destination takes the highest BW. I can see the CPU table showing IP input as the highest but i cant figure or isolate the exact IP that is causing the huge traffic.

I use Cisco 2600 series router running IOS 12.2 and my CPU gets 100% full and it shows as the IP input, when i reroute the traffic, the CPU comes to less than 2 % and that means its caused by some IP related stuff only.

I enabled IP accounting and that too will not give the exact detail as it shows all the source and destination IP.

I need to pin down to so that it shows top 10 users or similar to that so we can isolate.

milan.kulik · ‎07-30-2010

Hi,

NetFlow might be your chance if supported by your IOS.

NetFlow TopTalkes feature possibly?

See http://www.cisco.com/en/US/docs/ios/netflow/configuration/guide/cfg_nflow_top_talk_ps6922_TSD_Products_Configuration_Guide_Chapter.html#wp1057151

But if your router CPU is at 100% already, it might make the situation even worse as bringing an additional CPU load :-(

HTH,

Milan

Dipesh Patel · ‎07-30-2010

Dear,

You can do:

1. sh ip cache flow

it show:

Router#sh ip cache flow
IP packet size distribution (0 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 0 bytes
0 active, 0 inactive, 0 added
0 ager polls, 0 flow alloc failures
Active flows timeout in 30 minutes
Inactive flows timeout in 15 seconds
last clearing of statistics never
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts

2. you need to enable ip Netflow and than you can check using : sh ip flow top-talkers

Hope this will help you.

Please do not forget to rate the helpful post.

Regards,