id top talkers?

[jwa999999]

We have Cisco 3750G and 2960G switches. Not sure of the iOS level.

The network is vlan'd.

Is there a tool that will id the top talkers on a given vlan?

Or how do you id the top talkers on a given vlan?

I'm told by our network admin that there's no way to id the top talkers on the network.

I'm a bit skeptical of that statement. Can it be done?

[Leo Laohoo]

I'm told by our network admin that there's no way to id the top talkers on the network.

ROFL!

Or how do you id the top talkers on a given vlan?

Try this:

conf t

ip flow-top-talkers

top 10

sort-by bytes

cache-timeout 60000

end

sh ip flow top

[Richard Burts]

Using NetFlow to identify the top talkers is an excellent suggestion. However, as far as I can tell netFlow is not supported on 3750G or 2960G.

HTH

Rick

Sent from Cisco Technical Support iPad App

[Leo Laohoo · Accepted solution]

Using NetFlow to identify the top talkers is an excellent suggestion. However, as far as I can tell netFlow is not supported on 3750G or 2960G.

Good point.  But I think it would work if the 3750 was running on layer 3 feature set.

The commands do work on a 3750G but mine is running Layer 2 feature set.

[jwa999999]

leolaohoo wrote:
Using NetFlow to identify the top talkers is an excellent suggestion. However, as far as I can tell netFlow is not supported on 3750G or 2960G.
Good point.  But I think it would work if the 3750 was running on layer 3 feature set. 
The commands do work on a 3750G but mine is running Layer 2 feature set. 

How can I tell which feature set is installed? Is there a cmd that will tell you?  I dug this up in the switchintro.pdf.

The switch supports one of these feature sets:

• LAN base feature set,

• IP base feature set,

• IP services feature set,

[jwa999999]

leolaohoo wrote:
Using NetFlow to identify the top talkers is an excellent suggestion. However, as far as I can tell netFlow is not supported on 3750G or 2960G.
Good point.  But I think it would work if the 3750 was running on layer 3 feature set. 
The commands do work on a 3750G but mine is running Layer 2 feature set. 

Combine the cmds from your first post along with the hint  you need the layer 3 feature set, and it's good enough.

Thanks for cluing me in.

[Leo Laohoo]

Run the command "sh version".  Look at the entire line of the IOS version.  If your IOS version says, IP Base, then you're running Layer 2.  If your IOS version says "IP Services", then you are running Layer 3.

[jwa999999]

Richard Burts wrote:
Using NetFlow to identify the top talkers is an excellent suggestion. However, as far as I can tell netFlow is not supported on 3750G or 2960G.

HTH

Rick

Sent from Cisco Technical Support iPad App

I've read that too after some digging.  I've come across some stuff that mentions flexible netflow, and some Lanscope appliances for switches that don't support Netflow. Thanks for the feedback.

https://www.eiseverywhere.com/file_uploads/5685ec55c74e8c73f83ff9e901b088ac_Implementation-Lancope.pdf

http://blogs.manageengine.com/netflowanalyzer/2011/08/08/cisco-3k-switches-now-supports-netflow-export/

[jwa999999]

leolaohoo wrote:
I'm told by our network admin that there's no way to id the top talkers on the network.
ROFL!
Or how do you id the top talkers on a given vlan?
Try this:
conf t
ip flow-top-talkers
 top 10
 sort-by bytes
 cache-timeout 60000
end
sh ip flow top

Yep, I'd laugh too but I need the gig and we need some problems solved. note I don't claim to be a Cisco certified anything. Thanks for the cmd, I'll pass it along.  Appreciate you taking the time to answer.  Side note: Can you multiquote the replies?

[ALIAOF_]

Why don't you setup netflow on your firewall?  Also perhaps spanning the ports and using NTOP might be an option.

[jwa999999]

Mohammad Ali wrote:
Why don't you setup netflow on your firewall?  Also perhaps spanning the ports and using NTOP might be an option.

I'll see if the firewall supports netflow, it's not a Cisco fw.  Thanks for the suggestion on spanning the ports and NTOP.  I'm familiar with TOP in the Unix side of things.

[jwa999999]

All - i'm a sys admin grunt in a small shop (about 700 users) that's trying to help solve a slow performance problem across the network.  I don't have access to the switches and routers. Thanks again for the feedback.  Other helpful comments appreciated.  I'm searching the web, and reading the Cisco doc's.  Using doc id: 23637 as a guide, along with PTRG, Iperf, and Wireshark.

[johnlloyd_13]

hi,

make sure trunk ports on adjacent devices have same speed and duplex settings (auto/auto works most of the time).

some of our clients (retail shops) would scream slow internet but we've found out one of their PC is infected with a worm or virus. you may wanna check/scan on those too.

[jwa999999]

johnlloyd_13 wrote:
hi,
make sure trunk ports on adjacent devices have same speed and duplex settings (auto/auto works most of the time).
some of our clients (retail shops) would scream slow internet but we've found out one of their PC is infected with a worm or virus. you may wanna check/scan on those too. 

Thanks for the tip on the truck ports.  And we're checking out the users pc's.

[ALIAOF_]

Ok so what kind of firewall you guys do have?  When you say users are having slow network performance can you elaborate on that?  When users say that usually it can mean all kinds of things, so can you tell us what exactly they are having issue(s) with like slow internet or slow accessing a certain share or local intranet etc, Browser opening up slow?