high utlization between switch

[yeow_km]

I have 1 cisco 2960G connected to  core switch 3560G. The uplink port from 2960G to 3560G is occassionally  showing high utilization of 40% between 300MB-400MB during the night.

How can I find out what kind of traffic or applications that is occupying the bandwidth ?

the access switch (2960G) has some servers connected to it, while the core switch has uplinks to 4-5 access switch.

[Nathan Spitzer]

tshark (part of wireshark): http://www.wireshark.org/docs/man-pages/tshark.html

Simply set a laptop with a BIG HD and tshark sniffing the uplink, capture only about 128bytes per frame and set it to create a new file every 15 minutes. In the morning load the BIGGEST file with wireshark and then analyze it and it will tell you what the biggest conversation was.