Bandwith monitor for T1 ???? 1

[jaksen112]

I have a single t1 going from our NY office to the CT branch, cisco 3600's on each end, this isnt an internet t1, just data. I want to be able to inspect the data going across the line to determine whats bogging down the the connection lately, anybody know of a good product?

Thanks!
112 01110000

 

[dcss00]

First, I would like to suggest monitoring your LAN if you do not suspect the WAN as the actual cause of the problem.

The LAN is the source of traffic/BW on your T1.

Monitor the LAN router ports, see what protocols, hosts are sending/receiving traffic across the WAN.

Determine what is appropriate and what is not for your network.

There are many products for this but my company uses OptiView and Network Inspector from Fluke Networks to trend/baseline and monitor our traffic.

dcss00

 

[StarTAC]

also, setup MRTG for your router serial interface, to see how much bandwidth you are using on the WAN link.. this will help u understand whether your congestion is WAN related [in which case troubleshoot both LAN and WAN] or whether congestion on from your LAN...

good luck...

 

[havanajoe]

What is MRTG, I've never heard of that one. Please expand.

Thanks

 

[tbilan]

What you want is NBAR. Put a newer version of code on your router that supports it and then on your Serial interface add the command 'ip nbar protocol-discovery'.

MRTG is cool, I've used it for years, but it just tells you how much data is going through and not what kind of data it is.

It will keep stats of the traffic going through the router and when you do a 'show ip nbar protocol-discovery' you'll get something like this:

 Serial1/0
                            Input                    Output
   Protocol                 Packet Count             Packet Count
                            Byte Count               Byte Count
                            30 second bit rate (bps) 30 second bit rate (bps)
   ------------------------ ------------------------ ------------------------
   http                     258826                   271084
                            91387002                 274493354
                            9000                     115000
   icmp                     8779718                  197399
                            720910960                12584450
                            2000                     0
   netbios                  1743206                  0
                            961189852                0
                            0                        0
   snmp                     3143351                  718464
                            533769218                89904683
                            0                        0
   pcanywhere               1488542                  1315372
                            185642135                71809742
                            0                        0
   unknown                  12537125                 12524166
                            4976567362               8999552884
                            1000                     15000
   Total                    30329709                 16257482
                            7941627677               9722203857
                            12000                    130000

It's possible to write policies on the router that restict web traffic from a particular URL are only allowed to use up to 25% of your bandwidth etc. We do this all the time to set up QOS parameters for our enterprise customers.

Enjoy.

Tom Bilan
TJBA, Inc.
CCNP, CCDP, MCSE & CNE

 

[havanajoe]

Tom -

I am running 12.2(13) on a Cisco 2514 router and there is no such command as IP NBAR. What type of router/ios are you running?

 

[tbilan]

Get 12.2(13)T. T code has all the toys in it. Tom Bilan
TJBA, Inc.
CCNP, CCDP, MCSE & CNE

 

[kamil]

Hi adding a question here, I notice that the logs generated by "tbilan" are well formatted and has filtered traffic as HTTP, ICMP etc etc. I have MRTG working on my router but am unable to get such reports, all I see is a graph showing me the traffic, can you shed some light on how to configure such output.

I am running MRTG from a win2k box and making it monitor a few win2k servers plus one 800 series router, I do have other routers, BRIs and firewalls which I would like to monitor with such filtered log.

 

[MattWray]

That is not from MRTG. That looks like it is a command run directly in the router itself....

Thanks,

Matt Wray
MCSE, MCSA, MCP, CCNA

http://www.sss-steel.com

 

[rcasta]

It not only looks like, actually is what Nbar does. It takes a bit closer up to higher layers and check what's going through (transport layer mostly). You could even inspect an http URL content (was way useful when Nimbda or Code Red sprouted).

Further, it lets you define port numbers to take stats of. Although I guess it's CPU intensive (not entirely sure about this)

Best regards,

CCNA