who's using my bandwidth?


I've a simple LAN (80-ish nodes) connected by Cisco 2611 IOS v.12.2 to Internet. Once a while, our connection to Internet is very slow.

Is there a way to find out who (internal IP address) is using the bandwidth from the router?

Thank you.


Reply to
Loading thread data ...

Probably, you could use Netflow to determine what is passing the internet.

Reply to

Is it free?

Reply to

I am not certain if all IOS feature sets include netflow export but I think that they do.

formatting link
free for your application.

Netflow is firstly a method of selecting an output interface and creating the new packet headers necessary for that. That is a method of routing.

Secondly, it can gather statistics regarding the packets and the router can be configured to export these statistics to an external Netflow Collector.

prtg is a Netflow Collector.

I found it quite hard to work out what was needed to get this to go so here is an example config that I think was working.

int x ip route-cache flow int y ip route-cache flow

ip flow-cache timeout active 1 ip flow-export source FastEthernet0/0 ip flow-export version 5 ip flow-export destination 9996

It is not clear to me if you can have CEF and netflow at the same time but for almost all situations netflow is as good as CEF.

I guess: You need to remember that Netflow does its thing as part of the process of routing packets and will I suspect be applied at the output interface so you will need to turn it on on the EXTERNAL interfae at least in your case.

Be aware that statistics gathering/export uses router CPU (not much I guess) and memory.

Reply to

I too was also looking into a simlar solution.

My company has some ancient routers (2500) which our internet connetion goes through. But it works and in all fairness, if it broken, don't try to fix it.

However, one of our switches failed and replacing it with a 2960. During my research, it would seem that only the high-end Cisco switches support netflow.

So, what I have opted to try and implement SPAN (Cisco's implementation of port mirroring) and monitor the Internet connection off of the switch rather than the router and use something like Ethereal or some other app to analyse the data.

My 2 cents.

Reply to

what type of wan uplink do you have?

Reply to
christian koch

The 2611 is a router and it doesn't do SPAN.

The 2960 is a L2 device and doesn't do netflow.

All routers do netflow, some L3 switches seem to too.

Routers include:-

870, 1800, 2800, 3800, 7200

830, 1600, 1700, 2500, 2600, 3600, 3700

Reply to

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.