management of traffic

[dmalamba]

I Have a 64 k line which i am using for

connecting to the internet so that poeple

can send and receive mail through microsoftexchange server 5.5. I have implemented NAT

and access-list to permit mail through the

NAT interface. What stratles me is that the

64 k line seems to be at peak use all the time

and I dont believe this is the mail traffic

which is causing this. How can I check traffic typeS

passing through this interface and their port numbers

so i can block them? i.e only accept pop3 and smtp and probably www.

[Georg Pauwen]

Hello,

possibly one of the workstations on your network is infected with a virus or some other spyware. You could turn on ip accounting on the outgoing interface to see which source and destination address pair uses up most of the bandwidth. If e.g. your outgoing interface is Dialer1, configure the following on that interface:

interface Dialer1

ip accounting

ip accounting output-packets

In order to view the collected data, type:

Router#show ip accounting

HTH,

Georg

[olorunloba]

You could use netflow, to give you more accurate information. Netflow gives source and destination ip address, source and destination port, source and destination interface and ip protocol type. You will be able to know what traffic or host is really congesting.

On the interface, enable netflow by typing ip route-cache flow. Then do a show ip cache flow.

Also, you could use nbar.