Solved: How to LOG the incoming and outgoing HTTP request ?

Didier1966 · ‎12-13-2010

Hello,

I have a CISCO 1841 ROUTER and sins short our internet speed has decreased dramatically , it does not happens all the time , so I am sure it is not the ROUTER.

I have put a small router (CISCO WRT 610N) and it was the same.

When I look to the UP and DOWNLOAD GRAPH from my ISP , I see really BIG peeks.

I would like to see what is causing this ?!?

DEBUG ? LOG ?

Any help is welcome

Best Regards,

Didier

Atif Awan · ‎12-13-2010

Didier1966 wrote:

Hello,

I have a CISCO 1841 ROUTER and sins short our internet speed has decreased dramatically , it does not happens all the time , so I am sure it is not the ROUTER.

I have put a small router (CISCO WRT 610N) and it was the same.

When I look to the UP and DOWNLOAD GRAPH from my ISP , I see really BIG peeks.

I would like to see what is causing this ?!?

DEBUG ? LOG ?

Any help is welcome

Best Regards,

Didier

Have you considered turning on Netflow on the 1841 and looking at the top hosts from a traffic perspective? This will not only identify the top hosts but also the protocols in use. What it will not be able to tell you is that whether it is genuine HTTP traffic or some peer-to-peer application hiding itself behind port 80. If you need that level of visibility you can consider NBAR with appropriate PDLMs.

Atif

View solution in original post

Atif Awan · ‎12-13-2010

Didier1966 wrote:

Hello,

I have a CISCO 1841 ROUTER and sins short our internet speed has decreased dramatically , it does not happens all the time , so I am sure it is not the ROUTER.

I have put a small router (CISCO WRT 610N) and it was the same.

When I look to the UP and DOWNLOAD GRAPH from my ISP , I see really BIG peeks.

I would like to see what is causing this ?!?

DEBUG ? LOG ?

Any help is welcome

Best Regards,

Didier

Have you considered turning on Netflow on the 1841 and looking at the top hosts from a traffic perspective? This will not only identify the top hosts but also the protocols in use. What it will not be able to tell you is that whether it is genuine HTTP traffic or some peer-to-peer application hiding itself behind port 80. If you need that level of visibility you can consider NBAR with appropriate PDLMs.

Atif

Didier1966 · ‎12-14-2010

Hello Atif,

Thank you for this really good information

I am actually reading all the white pages and when I understand it I will implement it.

Thanks Again.

Best Regards,

Didier