Need statistics for mac host

[Volodymyr Khrystenko]

Hello.

Somebody in my company fills the whole channel. We have DHCP server so IP address can change. My boss wants to know who is it, so I need to collect statistics for out channel for one month. In statistics must be source mac and destination IPs. Could anyone advice any product (Cisco or non-Cisco) which could be able to collect statistics with mac included?

[lmediavilla]

I kind of think that you are using a cisco router as a dhcp server, you can use show dhcp binding to check who is using what and with software like cactools you can automate the login and the command and get an email with the result.

kind regards

[Volodymyr Khrystenko]

This solution, I believe, wont show statistics for month(

[lmediavilla]

now, its just for the day. You are asking for some kind of app that stores the result of the command in a DB

or you can runa  syslog server and debug ip dhcp server events and later check how many times in the month they repeat with each mac (if your are good with excel this could be a good solution)

probably somebody with more imagination knows a better way to solve your need.

cheers

[Volodymyr Khrystenko]

It is not realy what I have been looking for. I found Netflow tool but it classify traffic by IP. No MAC unfortunatelly(((

[pieterh]

On a switch that passes traffic to the router create a monitor port.
Capture packets using wireshark or something.
Configur wireshark to create multiple files with Max size or every hour.
Let wireshark show "top talkers".

One month is a long time to store captured data.
You may configure Some Trigger so capture only occurs at a certain bandwith use.

Sent from Cisco Technical Support iPad App

[sathvik k v]

HI,

Hope flexible netflow would help you. You would need  a router that support flexible netflow and a collector that supports.

http://www.cisco.com/en/US/docs/ios-xml/ios/fnetflow/configuration/15-mt/cust-fnflow-rec-mon.html#GUID-BD2CBC67-5DF7-4B2E-A0AE-95C1A72D2065

Example: Configuring Flexible NetFlow for Monitoring MAC and VLAN Statistics

The following example shows how to configure Flexible NetFlow for monitoring MAC and VLAN statistics.

This sample starts in global configuration mode:

!
 flow record LAYER-2-FIELDS-1
 match ipv4 source address
 match ipv4 destination address
 match datalink dot1q vlan output
 match datalink mac source address input
 match datalink mac source address output
 match datalink mac destination address input
 match flow direction
!
 exit
!
!
flow monitor FLOW-MONITOR-4
 record LAYER-2-FIELDS-1
 exit
!
ip cef
!
interface GigabitEthernet0/0/1
 ip address 172.16.6.2 255.255.255.0
 ip flow monitor FLOW-MONITOR-1 input

Also refer : http://www.plixer.com/blog/netflow/getting-mac-addresses-from-netflow-v9/

Regards,

Sathvik K V