How would you find the bandwidth hog?

[dennylester]

Okay, you get a call from a remote site claiming they are running very slow. My first response is to log into their router and see if the circuit is taking errors.

I find no errors but see the TX is running at 225/255.

How can I quickly determine which station(s) is using all this bandwidth up?

[pkhatri]

Hi Denny,

One thing you can quickly do is to use NBAR protocol discovery. Configure the 'ip nbar protocol-discovery' command under the appropriate interface. Then, issue the 'show ip nbar protocol-discovery' command which will show you bit-rates per protocol. It does not tell you which station is sourcing the traffic but does help you to isolate it at least to the application.

To get stats per station, I would enable 'ip accounting' on your interface. Then you can use 'show ip acounting' in conjuntion with 'clear ip accounting' to see where the traffic is coming from.

Hope that helps - pls rate the post if it does.

Paresh

[jpattishall]

I use NBAR to find the "hog" as well, but would also suggest configuring Top talkers if your IOS supports it. http://www.cisco.com/univercd/cc/td/doc/product/software/ios122s/122snwft/release/122s25/nflowtt.htm

You have to be on your game since it is real time, but it can show you what conversations are the top ones on your network and can be helpful in snapshot troubleshooting.

Jan

[spremkumar]

Hi

Two things i would like to add in addition to the other netpros suggestion.

1.Do check the bandwidth command configured under the interface where you are seeing TX ratio.

If the link connected is of high B/W capacity and you got to have the default bandwidth command set under the interface you may end up getting errorneous ratio.

2.You can also enable netflow in your router on the ethernet interface to check the geninuity of the traffic flow .

The commands ip route-cache flow configured under the interface mode will be able to provide the flow details,you can view those flow details using show ip cache flow command.The O/P will be give you the clear details of the source and destination ip address,port numbers used by the traffic flow.

if you find something fishy you can alwasy track down the source ip based on the port no thru which it transacts and bring it down which can also help to bring the network traffic to normal..

regds