Bandwidth troubleshooting on PIX

[dclee]

is there a way on the PIX to find a user on the internal side that is consuming most the of your public bandwidth ?

I have used the sho conn but its a busy firewall and hard to go thru all of the list

[paddyxdoyle]

Hi,

Probably the easiest way to do this is to use netflow on a router.

Maybe you have a router on the internet side of the PIX?

I'm hoping a previous post can help you:

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1dd8e859/0#selected_message

Rgds

PJD

[dclee]

Well I have managed to narrow down the the huge "sh conn" list by using the command sh conn | grep 0.00:00 which just shows me all the active connections that are not idle..I then look at the byte value to show me which IP is int he process of transfering a large amount of data..Its pretty easy to see it this way

So far I have been able to catch a few employees downloading huge Video files this way..

Cheers

DCLEE