Link utilization

[Michoud]

I've been using txload, rxload and input/output rates from the show interface fa0 command to determine current utilization on a link.

fa0 connects to the internet and fa1 connects to a hub with multiple PC's connected to it. Is there a way I can see what kind of traffic and how much traffic each PC is utilizing from the Cisco router?

Thanks!
Michoud

 

[ADB100]

If it's a 'proper' router then you can use NetFlow to gather the statistics. There is limited stuff you can do with the stats on the router itself, however you can export them to a server that can interpret them and produce nice stats about what applications are running, who are the top users etc.
Try NetFlow analyser from Adventnet:

http://manageengine.adventnet.com/products/netflow/index.html

They have an online demo and a free 30-day evaluation of their software. After 30-days the software will only manage two interfaces - which in your case might be enough!!

HTH

Andy

 

[Michoud]

What is a 'proper' router? NetFlow would work great, but I'm looking specifically for a "show" or some other command that I coud run in a terminal.

 

[ADB100]

The problem with this on a router is there is only a finite (small) amount of memory for the router to store statistics so NetFlow exporting is better as the NetFlow collector is typically a host with Disk storage space and can create more usable stats. You can look at Top Talkers & Top Protocols on the router through 'show' commands if you enable NetFlow, however as I said these are not 'trends' and only represent recent(ish) traffic:

router#show ip cache flow
IP packet size distribution (36908471 total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .011 .388 .008 .014 .012 .004 .003 .002 .002 .002 .002 .002 .002 .002 .002

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .003 .002 .015 .025 .489 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 278544 bytes
  10 active, 4086 inactive, 1209814 added
  20627661 ager polls, 0 flow alloc failures
  Active flows timeout in 1 minutes
  Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 25800 bytes
  9 active, 1015 inactive, 1196314 added, 1196314 added to flow
  0 alloc failures, 0 force free
  1 chunk, 1 chunk added
  last clearing of statistics never
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
TCP-Telnet         908      0.0        27    40      0.0      18.9      12.2
TCP-FTP            159      0.0         8    70      0.0      12.3       8.5
TCP-FTPD            67      0.0       143   982      0.0       6.1       7.9
TCP-WWW         482722      0.1        48   858      8.9       4.0       5.5
TCP-SMTP           174      0.0        13   531      0.0       2.8       6.5
TCP-X              381      0.0         1    40      0.0       0.0      15.4
TCP-other       232341      0.0        47   740      4.1      11.1       8.0
UDP-DNS          38198      0.0         1    66      0.0       1.6      15.4
UDP-NTP          44218      0.0         1    76      0.0       0.0      15.5
UDP-Frag            65      0.0         2   484      0.0       0.3      15.4
UDP-other       399818      0.1         3   275      0.5       1.5      15.4
ICMP             10239      0.0        79    52      0.3      14.7      12.8
IP-other            17      0.0        70   126      0.0      46.2       6.4
Total:         1209307      0.4        30   779     14.1       4.4      10.0

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Vl100         10.1.1.1        Di1           111.111.111.111 11 0103 0103     4
Vl100         10.1.1.1        Di1           111.111.111.112 11 0407 0ABA     6
Vl100         86.130.185.10   Null          111.111.111.113 06 067D 006E     1
Vi3           194.128.21.5    Vl100         111.111.111.114 11 0ABA 0407     1
Vl100         10.1.1.1        Di1           111.111.111.115 11 0103 0103     2
Vi3           192.122.81.124  Vl100         111.111.111.116 11 0103 0103     2
Vl100         10.1.1.2        Local         111.111.111.117 06 0678 0017    34
Vi3           84.72.201.221   Vl100         111.111.111.118 11 0103 0103     2
Vl100         10.255.255.2    Di1           111.111.111.119 11 007B 007B     1
Vl100         10.1.1.1        Di1           111.111.111.120 11 0103 0103     2
Vl100         10.1.1.1        Di1           111.111.111.121 11 0405 01F4     1
router#

and:

router#show ip flow top-talkers

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Vl100         192.168.200.11  Local         192.168.131.34  06 0678 0017    15
Vl100         192.168.201.12  Di1           216.200.12.130  11 0103 0103     4
Vl100         192.168.202.13  Di1           201.11.11.121   06 044D 0747     2
Vi3           85.2.54.11      Vl100         81.34.21.111    11 0103 0103     2
Vl100         192.168.200.11  Di1           85.2.54.11      11 0103 0103     2
5 of 5 top talkers shown. 14 flows processed.

router#

NetFlow exporting is the way forward though as this allows you to use historical data to create reports and see trends, threats etc.

HTH

Andy

 

[Michoud]

show ip flow top-talkers" looks like it would be very helpful in giving the kind of information I was looking for. Alas, I'm stuck with only user exec privileges on this particular router and NetFlow isn't enabled on this router. We actually use NetFlow on some of our other routers so getting the information I'm looking for on those is easy. It's a bit more difficult being stuck in user exec mode on our other routers.

Thanks for the useful information!