My customer has asked me to provide the ability to pinpoint the source of irregular high bandwidth use across their estate.
They have a small network of 3x 2960-48TC-S switches. I've installed and configured Cisco Network Assistant to monitor all three devices.
I'm not sure of the best way to explain the topology, but its as simple as you could hope.
FourthFloor-SW1 ══trunk═══╗
5thFloor-SW1 ──> DraytekVigor ──> ISP
GroundFloor-SW1 ══trunk══╝
ISP and Draytek are both showing irregular spikes of very high bandwidth utilization which saturate the the 10mbit line and cause connection failures for other clients on the network. Due to the nature of the business I won't hear about these connectivity issues until after they have occured, and they are irregular enough that I am unable to monitor when one is likely to happen as there is no pattern that I can make out.
What I would like to do is to be able to monitor each client on the network and when we've had confirmation of a spike in use I'd like to be able to go back to the time period and identify the source of the high use.
Currently the only way I can see to do this with the systems available to me is to monitor the Port Statistics on each switch. However this doesn't show the usage at a particular time; there would be no way to differentiate between a port thats had a continuous low use over several days and a port that has had a sudden spike of very high bandwidth use.
Ideally I'd like to be able to review Rx Rate and Tx Rate at any given point in time, what would be the recommended (or best or easiest) method for achieving this?
