Im reaching out to you for your suggestions in this matter. Without Netflow, how can one identify what hosts or flows are saturating a link on Cisco devices that dont support netflow? Solarwinds NPM can tell me a link is being saturated but without the device being netflow capable I have no way of telling whats causing the saturation. Are there any products out there that can do this? Any tips or tricks you know about to identify bandwidth hogs on links (layer 2 and layer 3)? Thanks.
Its a 3750x switch. Layer 2 uplink to an AT&T Opti-MAN circuit. Solarwinds NPM can tell me how saturated the link is via bandwidth utilization but i have no way of knowing what devices or traffic flows are causing it.
If you are just doing it for a short period, span the MAN port to another port, and plug in a notebook with Wireshark. Leave a big capture running, and then let Wireshark summarise it for you.
Thanks for the tip. Are there any other more "long term" solutions you recommend? It seems the main option is to set up SPAN for selected interfaces you want to monitor and send the traffic to some 3rd party device or software.
