how to check top talkers on ASA anyconnect??

[haedongchan]

Hi guys,

I am looking for an information to check top5 or top10 talkers on ASA anyconnect

the version of the device is Cisco Adaptive Security Appliance Software Version 9.6(4)36,

actually, I am looking for the command

in addition, if I can see more detailed information with top talkers including userid, bytes, duration etc

that would be much better for me.

pls help me on this

[balaji.bandi]

Good thread for reference to achieve :

https://community.cisco.com/t5/network-security/asa-top-talkers/m-p/3213007

here also good reference ASA best practice to help :

https://community.cisco.com/t5/security-documents/asa-best-practices-for-remote-access-vpn-performance/ta-p/4070579#toc-hId-1133748824

[Marvin Rhoads]

Something like this would work:

> show vpn-sessiondb detail anyconnect filter name marvin.rhoads | include User|Bytes|ID|Duration
Username     : marvin.rhoads          Index        : 19324
Bytes Tx     : 26285096               Bytes Rx     : 2658712
Duration     : 2h:47m:14s
Audt Sess ID : ac1e010404b7c0005ef73004
  Tunnel ID    : 19324.1
  Bytes Tx     : 9621                   Bytes Rx     : 0                      
  Tunnel ID    : 19324.2
  Bytes Tx     : 10307                  Bytes Rx     : 2182                   
  Tunnel ID    : 19324.3
  Bytes Tx     : 26265168               Bytes Rx     : 2656530                
>

I filtered on my username but leave out the filter and you will see all users.

[haedongchan]

Thanks. Marvin Rhoads,

your information is very useful, 

but I want to ask you a seceral questions additionally

how can I arrange the result from the most traffic user to less traffic user....

and isn't it possible to set the period, one week or one month something like that??

if you know how to do it....pls leave me a message again...

Thanks again my friend....

[balaji.bandi]

As per I know, the feature you no available built-in,  I have not seen any time, but you can export that statistic to out of the box to make reports as per the custom needed.

[Marvin Rhoads]

As @balaji.bandi mentioned, there's no built-in feature for such customized data presentation - only the primitives like include, exclude etc. such as I demonstrated. If you want to sort and store for presentation, trending etc. then use a third party system or tool. You could use the free PRTG version or, for more robust requirements, something like SolarWinds NPM.

[haedongchan]

ok, Thanks for the help

[haedongchan]

hi, I need your help.

 we use cisco anyconnect SSL VPN, 

but sometimes it disconnects the connection.....I want to see the log and figure out how to do not to happen this kind of problem.

if you know some command, or ways....pls let me know

Thanks.

[Marvin Rhoads]

If a client terminates the connection sometimes the Diagnostics and Reporting Tool (DART) logs from the client can tell us why. They can be quite verbose though and best suited for TAC usage. The ASA has some logs (assuming logging is enabled) but if the problem is at the client or in the Internet then the ASA usually won't see that.

As with any problem, some first level analysis is in order. For instance:

- Did this start happening recently? If so, what changed

- Is it happening to all clients or just a subset?

- If the latter, what do they have in common?

- Is there anything going on with the ASA or its Internet connection at the time of connections being dropped?

...etc.