How to find the largest user in a Cisco Router

[TRACKME_2]

Dear All,

I would like to know how to isolate in a cisco router which Source or destination takes the highest BW. I can see the CPU table showing IP input as the highest but i cant figure or isolate the exact IP that is causing the huge traffic.

I use Cisco 2600 series router running IOS 12.2 and my CPU gets 100% full and it shows as the IP input, when i reroute the traffic, the CPU comes to less than 2 % and that means its caused by some IP related stuff only.

I enabled IP accounting and that too will not give the exact detail as it shows all the source and destination IP.

I need to pin down to so that it shows top 10 users or similar to that so we can isolate.

[milan.kulik]

Hi,

NetFlow might be your chance if supported by your IOS.

NetFlow TopTalkes feature possibly?

See http://www.cisco.com/en/US/docs/ios/netflow/configuration/guide/cfg_nflow_top_talk_ps6922_TSD_Products_Configuration_Guide_Chapter.html#wp1057151

But if your router CPU is at 100% already, it might make the situation even worse as bringing an additional CPU load :-(

HTH,

Milan

[Dipesh Patel]

Dear,

You can do:

1. sh ip cache flow

it show:

Router#sh ip cache flow
IP packet size distribution (0 total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 0 bytes
  0 active, 0 inactive, 0 added
  0 ager polls, 0 flow alloc failures
  Active flows timeout in 30 minutes
  Inactive flows timeout in 15 seconds
  last clearing of statistics never
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow

SrcIf         SrcIPaddress    DstIf        DstIPaddress    Pr SrcP DstP  Pkts

2. you need to enable ip Netflow and than you can check using : sh ip flow top-talkers

Hope this will help you.

Please do not forget to rate the helpful post.

Regards,