Can't find bandwidth hog

[jasonarthur]

We have a T-1 connection that is consistently slow behind the PIX. Could the PIX be causing this? If not, then my main need is some way to locate where the bottleneck is. I've been referred to many software packages that do this but have been unsuccessful in finding one that makes sense to me. I would like to precisely see how much traffic is being used by each connection in/out the private/public interfaces of the PIX or router in a format that a child could interpret. Is such a thing out there?

[gfullage]

Hard to do on the PIX, although you do a "sho conn" which will show you all the active connections and how much traffic has passed on each one.

On an IOS router though, you have a couple of choices. You can configure "ip accounting" on the serial interface and this keep track of all conversations going on on that link, based on source and destination IP address. You can then see who are the "top-talkers". See http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123cgcr/ipras_r/ip1_i1g.htm#wp1091971 for details.

A better way is to enable NetFlow on the serial link. This'll give you much more information, see http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fswtch_c/swprt2/index.htm for details.