Catalyst 3548 to WAN Link, Can I measure?

[kmontgomery]

Hi Everyone. I have a Catalyst 3548 switch (SMI) that I have connected to another Catalyst 3548 over a Microwave WAN connection. I would like to be able to monitor the traffic type, bandwidth usage on it and also I'd like to be able to graph bandwidth usage by destination address of all traffic crossing it... does anyone know of a tool that will assist me with this process? Can it be done through MRTG? If so, which method would you use to accomplish it?

All answers appreciated... thanks!

[Pavel Bykov]

The methods I know of are:

For traffic type (traffic inspection) you can use NBAR. It's turned on using "(config-if)#ip nbar protocol-discovery" command.

Statistics are then displayed using "#show ip nbar protocol-discovery" command.

For traffic by destination, you can use "(config-if)#ip accounting" And display statistics using "#show ip accounting"

You then would use MIBs of those tools to map them into MRTG.

MIBs are:

For NBAR:

http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&mibName=CISCO-NBAR-PROTOCOL-DISCOVERY-MIB

For IP accounting:

http://www.cisco.com/en/US/customer/tech/tk648/tk362/technologies_tech_note09186a0080094aa2.shtml#ipaccounting

Hope this helps.

Please rate all useful posts.

[paolo bevilacqua]

Slidersv, the question is about a catalyst 3560 switch, that doesn't support nbar that is a router feature.

Actually the switch is quite limited in supporting netflow features, so I was suggesting in another thread that a router like 2800 or 100 is used for the purpose.

[Pavel Bykov]

Oops, you are right Paolo :)

Numbers 3548 got mixed up in my mind as 3845 :)

[avmabe]

span a port and use http://www.ntop.org

[paolo bevilacqua]

Great suggestion.

[kmontgomery]

Ok, I'll give that a shot. I'm a little shaky on the span a port thing. What my overall goal is to show the bandwidth that link is using and also which traffic is taking up the majority of it. I'll see what I can come up with. Thanks for the advice.

[kmontgomery]

That works, with the SPAN activated... now I just need to find one that allows more than 100 packets to be captured and will provide a more detailed graph of host vs. bandwidth... thanks everyone.