Identify what is using up bandwidth?

[emphillips00]

Hi all,

We have a small MPLS network made up of 12 remote sites with Internet access being provided from the head-end node.

We are having issues with the bandwidth across the MPLS network being insufficient. We are regularly seeing over 1 Mbit/sec being in use on the interfaces.

What are my options to identify what that traffic is? I have done some research, and it looks like CiscoWorks can do that, but I do not see anywhere that says that specifically.

I know that Cisco's NetFlow allows this sort of granularity, but I do not know how to use that data.

How are you all able to figure out what is being used on your network?

Thanks,

Eric

[mheusinger · Accepted solution]

Hi,

try "ip nbar protocol-discovery" on the interface level. This will not give you the granularity of NetFlow, but will allow you to determine the protocol/application causing the load. You can use "show ip nbar protocol-discovery top-n 10" to show the top 10 with respect to number of packets/bytes.

Other than that I would also check with a sniffer, what kind of traffic is on your network.

Hope this helps!

Regards, Martin

[emphillips00]

"ip nbar protocol top 10" is a very cool command! I am definitely going to have to keep that in mind!

As I expected, gntuella is the top bandwidth usage on my network.

I downloaded a package called ManageEngine NetFlow Analyzer http://manageengine.adventnet.com/products/netflow/index.html and have been playing with it. It does NetFlow analysis on a flow-basis (ie... this IP is going to this IP on port 80 and is using 300KB/sec) in a very nice graphical format. I am going to give this a shot.

But I am still curious if anything in CiscoWorks can do this too... Perhaps I should ask in the management forum.

Thanks again Martin!

-Eric

[royalblues]

I don't know of any Cisco works capability in analaysing the network traffic.

The netflow analyser you downloaded is probably the best i have ever encountered.

Solarwinds too has its own netflow analyser but shows only the destination end point and no source

HTH

Narayan