who's using my bandwidth?

Probably, you could use Netflow to determine what is passing the internet.

Is it free?

I am not certain if all IOS feature sets include netflow export but I think that they do.

Netflow is firstly a method of selecting an output interface and creating the new packet headers necessary for that. That is a method of routing.

Secondly, it can gather statistics regarding the packets and the router can be configured to export these statistics to an external Netflow Collector.

prtg is a Netflow Collector.

I found it quite hard to work out what was needed to get this to go so here is an example config that I think was working.

int x ip route-cache flow int y ip route-cache flow

ip flow-cache timeout active 1 ip flow-export source FastEthernet0/0 ip flow-export version 5 ip flow-export destination 192.168.123.123 9996

It is not clear to me if you can have CEF and netflow at the same time but for almost all situations netflow is as good as CEF.

I guess: You need to remember that Netflow does its thing as part of the process of routing packets and will I suspect be applied at the output interface so you will need to turn it on on the EXTERNAL interfae at least in your case.

Be aware that statistics gathering/export uses router CPU (not much I guess) and memory.

I too was also looking into a simlar solution.

My company has some ancient routers (2500) which our internet connetion goes through. But it works and in all fairness, if it broken, don't try to fix it.

However, one of our switches failed and replacing it with a 2960. During my research, it would seem that only the high-end Cisco switches support netflow.

So, what I have opted to try and implement SPAN (Cisco's implementation of port mirroring) and monitor the Internet connection off of the switch rather than the router and use something like Ethereal or some other app to analyse the data.

My 2 cents.

what type of wan uplink do you have?

The 2611 is a router and it doesn't do SPAN.

The 2960 is a L2 device and doesn't do netflow.

All routers do netflow, some L3 switches seem to too.

Routers include:-

830, 1600, 1700, 2500, 2600, 3600, 3700