Replicate all traffic on one port; Cisco 6513

[indys28]

Is it possible to replicate all the traffic coming to a Cisco 6513 switch to one port in order to monitor cumulative internal and external traffic on the LAN? I'm looking to get an accurate reading on all traffic going across my LAN from the switch which sits behind my router. If not, any other suggestions??? Thanks, in-advance..

 

[chipk]

You need a monitoring tool like MRTG. Port mirroring / SPAN is only going to give you part of the picture.

 

[indys28]

Thank you Chip. We've actually got MRTG up and running now. Is there a way to show cumulative traffic totals vs. traffic for one node?

 

[chipk]

Is the 6513 the only switch you have, or do you have trunks going to access switches? Cisco Network Assistant, which comes with most routers, is a pretty good tool. It's got bandwidth graphs, but won't show you aggregate bandwidth as far as I know.

For MRTG, I suppose what you could do is cat all your log files, usually under /var/

http://www/html/mrtg,

the second line of all these log files is the most recent mrtg performance counter. You'd basically extract the 2nd line of each log file: column B is average incoming xfer rate for the interface, column C is average outgoing xfer rate. Toss that data into Excel or something and use a formula to add it all up, and presto, you've got your traffic details. Oh, and you'd want to make sure you only did the physical interfaces.

That's how I'd do it with my "do it yourself" mindset. There may be someone with a suggestion for another package.

 

[indys28]

Awesome Chip. Thanks for the reply. I'm always open for new suggestions if anyone else has a tool they use as well. Thanks!