Search this Blog

Friday, November 15, 2013

Monitor and identify traffic on the Gigabit Interface



Need to monitor and identify the traffic on the WAN GigabitEthernet0/3 interface. Recently after some changes to our network we discovered that our traffic to outside world via this link is doubled from 150-200 to 350 MB/sec (we use MRTG for bandwidth), we suspect there are something looping in the network. That is why I want to trace what is going via Gig0/3 in and out (mostly out). What are the suggestions on how to trace down and identify the what causing such a big spike in the outbound bandwidth?

While replication of the port seems to be a good tool Im not sure that any laptop with packet tracer can handle 300 mb/s of traffic. But, what are suggestions?


Router Specs:

cisco 7204VXR (NPE-G1) processor (revision B) with 983040K/65536K bytes of memory.
Processor board ID 18281405
SB-1 CPU at 700MHz, Implementation 1, Rev 0.2, 512KB L2 Cache
4 slot VXR midplane, Version 2.0

Last reset from power-on
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.

PCI bus mb1 (Slots 1, 3 and 5) has a capacity of 600 bandwidth points.
Current configuration on bus mb1 has a total of 400 bandwidth points.
This configuration is within the PCI bus capacity and is supported.

PCI bus mb2 (Slots 2, 4 and 6) has a capacity of 600 bandwidth points.
Current configuration on bus mb2 has a total of 90 bandwidth points.
This configuration is within the PCI bus capacity and is supported.

Please refer to the following document "Cisco 7200 Series Port Adaptor
Hardware Configuration Guidelines" on Cisco.com <http://www.cisco.com>
for c7200 bandwidth points oversubscription and usage guidelines.


2 FastEthernet/IEEE 802.3 interface(s)
3 Gigabit Ethernet/IEEE 802.3 interface(s)
1 ATM network interface(s)
509K bytes of non-volatile configuration memory.

As a starting point you may be able to spot the top talkers by enabling ip accounting on the interface.

conf t
!
interface gi0/3
ip accounting output-packets
!
end


show ip account


This will build a table of bytes & packet sent from source ip adresses to destination ip addresses.

Something like this:-

router_10.64.7.2#
show ip account

    Source         Destination              Packets               Bytes
172.17.110.208  172.17.110.223            25                   2500
10.64.7.26       172.17.111.59               13                   1092


to turn off

conf t
!
interface gi0/3
no ip accounting output-packets
!
end

Along with this enable netflow to get a detailed information.

Citation - This blog post does not reflect original content from the author. Rather it summarizes content that are relevant to the topic from different sources in the web. The sources might include any online discussion boards, forums, websites and others.

No comments :

Post a Comment

 
/* Google Analytics begin ----------------------------------------------- */ /* Google Analytics end ----------------------------------------------- */