I've got several remote sites using catalyst 4500s that have been showing some unusual traffic lately. I'm trying to find out ways to determine what's been going on. I would like to turn on NetFlow and use that, but I don't have the necessary hardware. Are there any alternatives that might help?
Thanks!
--Steve
Have used the following IOS commands on lessor models to view such data from the CLI (when a NetFlow collector was unavailable).
router (config) # ip flow-top-talkers router (config) # top 25 router (config) # sort-by packets
router # show ip flow top-talkers
Best Regards, News Reader
Is this a NetFlow command? I may have been a little unclear ... I don't have NetFlow available at all (the Catalyst 4500 needs a feature card and the proper version of the supervisory engine, neither of which I have at any of the sites).
Thanks for your response, though...
--Steve
Yes it is. Sorry about that.
Don't have access to a 4500, and wasn't aware of the additional hardware required to support NetFlow. Even branch office gear (800, 1700 series) can do NetFlow. Although maybe not on such a grand scale.
Thought you were conveying that you didn't have hardware (a host) to export the data too. Thought I was helping with commands that would allow CLI visibility into the data.
Usually I wouldn't respond to posts regarding platforms beyond what I have to work on, but I do see posters (others, not you) with responsibilities well beyond their abilities, and thought I'd take a shot at this post.
;>)
Thanks for the considerate response.
Best Regards, News Reader
Yes, that is using netflow.
The 4500 Sup IV/V platforms require an additional hardware module added to the SUP engine to handle netflow.. (part # WS-F4531)
I don't know the answer either, although I'd like to get some of the $3000 modules in my 4500's to see if the flow talkers command suddenly becomes available.
It's not ideal however, have you considered SPANning the traffic to a port and gathering some stats that way? Wireshark will give fairly limited conversation analysis but it may well do the job - especially if it's a simple traffic pattern.
I have the idea that there are applications that will present information gathered in this way in a decent manner. Charts, stuff like that.
Here is one at random
This one has a free trial
Have something to add? Share your thoughts — no account required.
Ask the community — no account required