PIX 506E Bandwidth Usage by internal IP

[alanmcg]

Hi,
I am seeing internet slowdowns on my network. I am monitoring the PIX 506E using cacti and can see that all of our bandwidth is being used and peaking for up to 1 hour at a time. I have plenty of bandwidth for the number of users so someone is obviously doing something they shouldn't be. Does anyone know of a way to see how much bandwidth is being used by each internal IP?

Thanks

 

[hgate73]

I'm not very savvy with the Pix itself (I'm just in Network Security 1 class), but the way we would track down high-bandwidth users was either with SNMP (start with the 'snmp-server' command on the Pix) or with NetFlow.

If there isn't a way with the Pix specifically (although I think there is, in the GUI somewhere?), you can always install a transparent Linux proxy (IPcop is pretty easy to use) in between the Pix and your users, and take a look at who your high-bw users are.

 

[brianinms]

Use the command "show local" to see who is using all the connections.

 

[NetworkGhost]

During the time of a slow down do the following:


sh conn count

sh conn


Each connection will have the amount of data that has passed for that connection. Copy the screen output and store it in a file like notepad.

Open the file in Excel delimated by a space. Sort by bytes first and then by IP. See who the top talkers are.

http://www.wr-mem.com