topic Re: how to find IP that is hogging bandwidth in Network Security

how to find IP that is hogging bandwidth

tato386 — Mon, 11 Mar 2019 14:11:01 GMT

I am using a an ASA5520 with a few hundred users connected to the Internet with a 20MB ethernet circuit. Our bandwidth usage (from the home screen of the ASA) usually is at 3-5MB or so. Lately the home screen shows the input bandwidth to our public interface as pegged 24x7 at 20MB which is the max allowed by our ISP. I am trying to use the ASA tools to find the IP responsible but haven't had much luck. Packet tracing and logging tools require specific IPs and ports which doesn't help me because if I knew which IP and port I was looking for then I wouldn't have to use the tool! Seems like most of the screens and graphs are geared to showing overall statics for specific interfaces but they can't drill down to specific IPs. Any ideas on how I can find this rouge IP(s)?

Thanks,

Diego

Re: how to find IP that is hogging bandwidth

acomiskey — Mon, 10 Nov 2008 20:01:21 GMT

What version of ASA? ASDM 6 has a feature which allows you to see top sources/destination/services.

Re: how to find IP that is hogging bandwidth

tato386 — Mon, 10 Nov 2008 20:05:42 GMT

Using 5.2.4 and 7.2.4 on the ASA. Will try to upgrade to see what's new. Where do I look for this feature when I'm there?

Re: how to find IP that is hogging bandwidth

acomiskey — Mon, 10 Nov 2008 20:24:28 GMT

Main page -> Firewall Dashboard Tab -> Top Usage Status

Re: how to find IP that is hogging bandwidth

tato386 — Mon, 10 Nov 2008 21:49:03 GMT

As soon as I finished upgrading the ASA and ASDM the problem went away, at least for now. I will continue checking but now there is no need to use the top usage stats. Weird. Nevertheless the new ASA/ASDM is a nice upgrade. Thank you!!

Diego