Somebody in my company fills the whole channel. We have DHCP server so IP address can change. My boss wants to know who is it, so I need to collect statistics for out channel for one month. In statistics must be source mac and destination IPs. Could anyone advice any product (Cisco or non-Cisco) which could be able to collect statistics with mac included?
I kind of think that you are using a cisco router as a dhcp server, you can use show dhcp binding to check who is using what and with software like cactools you can automate the login and the command and get an email with the result.
now, its just for the day. You are asking for some kind of app that stores the result of the command in a DB
or you can runa syslog server and debug ip dhcp server events and later check how many times in the month they repeat with each mac (if your are good with excel this could be a good solution)
probably somebody with more imagination knows a better way to solve your need.
On a switch that passes traffic to the router create a monitor port.
Capture packets using wireshark or something.
Configur wireshark to create multiple files with Max size or every hour.
Let wireshark show "top talkers".
One month is a long time to store captured data.
You may configure Some Trigger so capture only occurs at a certain bandwith use.
Sent from Cisco Technical Support iPad App
Hope flexible netflow would help you. You would need a router that support flexible netflow and a collector that supports.
The following example shows how to configure Flexible NetFlow for monitoring MAC and VLAN statistics.
This sample starts in global configuration mode:
! flow record LAYER-2-FIELDS-1 match ipv4 source address match ipv4 destination address match datalink dot1q vlan output match datalink mac source address input match datalink mac source address output match datalink mac destination address input match flow direction ! exit ! ! flow monitor FLOW-MONITOR-4 record LAYER-2-FIELDS-1 exit ! ip cef ! interface GigabitEthernet0/0/1 ip address 172.16.6.2 255.255.255.0 ip flow monitor FLOW-MONITOR-1 input
Sathvik K V