12-09-2013 02:32 PM - edited 03-04-2019 09:48 PM
Hello.
Somebody in my company fills the whole channel. We have DHCP server so IP address can change. My boss wants to know who is it, so I need to collect statistics for out channel for one month. In statistics must be source mac and destination IPs. Could anyone advice any product (Cisco or non-Cisco) which could be able to collect statistics with mac included?
12-09-2013 02:38 PM
I kind of think that you are using a cisco router as a dhcp server, you can use show dhcp binding to check who is using what and with software like cactools you can automate the login and the command and get an email with the result.
kind regards
12-09-2013 02:42 PM
This solution, I believe, wont show statistics for month(
12-09-2013 03:00 PM
now, its just for the day. You are asking for some kind of app that stores the result of the command in a DB
or you can runa syslog server and debug ip dhcp server events and later check how many times in the month they repeat with each mac (if your are good with excel this could be a good solution)
probably somebody with more imagination knows a better way to solve your need.
cheers
12-25-2013 02:09 PM
It is not realy what I have been looking for. I found Netflow tool but it classify traffic by IP. No MAC unfortunatelly(((
12-26-2013 05:45 AM
On a switch that passes traffic to the router create a monitor port.
Capture packets using wireshark or something.
Configur wireshark to create multiple files with Max size or every hour.
Let wireshark show "top talkers".
One month is a long time to store captured data.
You may configure Some Trigger so capture only occurs at a certain bandwith use.
Sent from Cisco Technical Support iPad App
12-27-2013 12:08 AM
HI,
Hope flexible netflow would help you. You would need a router that support flexible netflow and a collector that supports.
The following example shows how to configure Flexible NetFlow for monitoring MAC and VLAN statistics.
This sample starts in global configuration mode:
! flow record LAYER-2-FIELDS-1 match ipv4 source address match ipv4 destination address match datalink dot1q vlan output match datalink mac source address input match datalink mac source address output match datalink mac destination address input match flow direction ! exit ! ! flow monitor FLOW-MONITOR-4 record LAYER-2-FIELDS-1 exit ! ip cef ! interface GigabitEthernet0/0/1 ip address 172.16.6.2 255.255.255.0 ip flow monitor FLOW-MONITOR-1 input
Also refer : http://www.plixer.com/blog/netflow/getting-mac-addresses-from-netflow-v9/
Regards,
Sathvik K V
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide