2800 Router - Upload Issue

[Amin Shaikh]

Hi,

We have 2800 Series Router connected to internet with 1Mbps bandwidth.

Our MRTG graph shows full utilization, is there a way to check which host on the network is doing upload.

How to check upload traffic.....

[Thotsaphon Lueangwattanaphong]

Hi Amin

I'm not 100% sure about your question. If you want to monitor someone who try to access to somewhere through 2800 router I just recommend you using the netflow.you can know what are udp/tcp ports that users(IP addresses) use.

What's netflow? please check this link out.

http://www.cisco.com/en/US/products/ps6601/products_ios_protocol_group_home.html

you can mitigate your problem by using police mechanism.

http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124cr/hqos_r/qos_o1h.htm#wp1084068

I hope that you won't do NAT before forwarding packets to 2800 router. ;-)

Hope this helps

Thot

[spremkumar]

Hi

you can try enabling netflow in your router to check up the top user whos having high transactions.

you need to configure ip route-cache flow under the ethernet interface once you have done the same you can check/verify the transactions using show ip cache flow command this will give you details of source/destination ip address as well port number details with packet counts.

this will help you to identify which ip's are having are involved in more number of transactions.

regds

[william.caban]

If you have a good knowledge of *nix you can use NetFlow and export it to a machine to process it with flow-tools. There is also "ntop" a freeware that can give you the information you are looking for. This last one can either receive NetFlow or capture and classify packets and give you very nice graphs with the information you are looking for.

HTH,

-W

[Amin Shaikh]

Thansk to all for your reply....

William can you ellaborate more on your input (NIX... which free-tools you are addressing about...

[paitken]

Once you have netflow configured, you can use netflow top talkers to see the biggest offenders right there on the box.

See here:

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a00805e11ab.html