Monitoring 2600 router activity

[admin_2]

I have a 2600 router on my side of a t1 wan there should not be much activity but the activity light flashes constantly.

I would like to monitor the activity and see what IP is hammering to possiblity stop an internal virus pinging.

What would you recommend for a w2k network.

Thanks

[pradeepde]

You can use the sniffer to find from where the packets are being sourced.

[r.wilcox]

You could add the "ip accounting" command to the interface and then do a "sh ip accounting". This will give you a list of source and destination IP's as well as the number of packets sent. This is good for detecting viruses like Blaster (1 packet, 48 Bytes).