ASDM sees traffic maxed out, but who is causing it!!?

The ASDM GUI is a pleasant change from the antiquated CLI of IOS (I have dyslexia and cannot use CLI) but...

I can see when our 200 PC lan is maxing out the t1 line in the "Outside Interface traffic usage" window

but how do I see which of the 192.168.0.x Vista PC's is using the bandwidth?

I've been through every screen in ASDM. I cant seem to find it.

someone told me to use cacti, but I cant get it working.


Reply to
Loading thread data ...

Cacti won't tell you, but Netflow will.

Reply to

There are a few "free trial" netflow software packages available. I am not in a position to recommend one at present.

Perhaps a simpler idea is to use ip accounting. Trouble with this is that you can only configure

ip accounting output-packets

If you put this on the inside interface you might be able to get an idea of what is going on regarding inbound traffic.

If you are being constrained by outbound traffic then this will not work very well since by the time the packets get there they have been NATted and they may all have the same source address. Worth remembering that TCP sends an ACK every second data packet "by default".

clear ip account ! -- resets the counters sh ip account ! -- displays the info

Reply to

You didn't wrote which version of ASA software you have. Some older versions earlier then 8.0 AFAIK cannot use netflow, but they can use syslog, so you may use some of the firewall analyzer software which do parsing of syslogs into a nice set of views (charts, tables, etc) about all traffic passing trough the firewall (including special reports about dropped ones). I'm using this one:

formatting link
you can use it as a trial or maybe even for free if you have only one firewall with 2 interfaces you wish to monitor.

If you have a newer ASA software then you can use a netflow. For that again I'm using ManageEngine NetFlow analyzer or something like that...Here is the link for manageengine:

formatting link
If it's not free anymore you can try googling for some from other manufacturers that offers free software (open source community maybe). A great think about both applications is that they are using database (I think mysql - for windows) so that you can have traffic data from past days, weeks, months, etc.

Regards, Igor

Reply to
Igor Mamuzic aka Pseto Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.