Currently I have a CISCO 7246VXR uBR chassis that has a direct DS3 connection using a PA-M1T-T3 and connects point to point into a GSR 12016 chassis.
Every few days around 12:00am PST, the rx load on the interface (S1/0) goes up to 253/255, while the tx load stays around 24/155.
The entire DS3 is saturated with inbound trafic during a specific time period and I suspect this may be someone running a backup or data base archive over the DS3 from a cable modem host.
Here is the show interface S1/0:
Serial1/0 is up, line protocol is up
Hardware is M1T-T3 pa
Internet address is 172.29.64.250/30
MTU 4470 bytes, BW 44210 Kbit, DLY 200 usec,
reliability 255/255, txload 24/255, rxload 253/255
Encapsulation HDLC, crc 32, loopback not set
Keepalive set (10 sec)
Restart-Delay is 0 secs
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters 1d22h
Input queue: 0/2046/0/6125 (size/max/drops/flushes); Total output drops: 79087629
Queueing strategy: fifo
Output queue :0/2046 (size/max)
5 minute input rate 43962000 bits/sec, 5605 packets/sec
5 minute output rate 4277000 bits/sec, 4918 packets/sec
616732802 packets input, 1105854862 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 parity
4 input errors, 0 CRC, 0 frame, 4 overrun, 83 ignored, 0 abort
631574427 packets output, 3813633369 bytes, 17 underruns
0 output errors, 0 applique, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
0 carrier transitions
rxLOS inactive, rxLOF inactive, rxAIS inactive
txAIS inactive, rxRAI inactive, txRAI inactive
I am looking for suggestions on how to identify the types of traffic over the DS3 to track down any particular hosts that may be over utilizing the DS3 so I can rate-limit their usage.
Please offer any ideas you can think of,
