traffic flow [7:73495]
Hey All, Got a question about traffic flow into and out of a branch office. I have a branch office with only a handful of users, but with high demands on the WAN. This particular office has a 256k/32k frame connection into me (the HQ) but a crying out for greater bandwidth and pipe access. What my problem is, is understanding how these users are using up all there network bandwidth. I have no access list in place between me and them (however I will be going down this road). Whats I want to do, is have a look at the traffic and determine what type of traffic it is. I bet we have people in that office just watching video of the CEO from the HQ. I have enabled IP NBAR on the serial and Ethernet interfaces and have noticed that 70% of the traffic, is unclassified. How can I view this data to just get then router to tell me the IP source and the port number associated with this traffic? I also would like to put down a quality of service map for known business applications, and grant them priority over any other traffic. Has any one done this and if so can you send snippets of your config or link to doco's Thanks all for your help John Sydney Australia ** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.solution6.com ** Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=73495&t=73495 -- **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
RE: traffic flow [7:73495]
Before applying a service policy, enable NetFlow to see source and destination addresses and port numbers. Best regards, Dom Stocqueler SysDom Technologies Visit our website - www.sysdom.org -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Brandis Sent: 05 August 2003 07:02 To: [EMAIL PROTECTED] Subject: traffic flow [7:73495] Hey All, Got a question about traffic flow into and out of a branch office. I have a branch office with only a handful of users, but with high demands on the WAN. This particular office has a 256k/32k frame connection into me (the HQ) but a crying out for greater bandwidth and pipe access. What my problem is, is understanding how these users are using up all there network bandwidth. I have no access list in place between me and them (however I will be going down this road). Whats I want to do, is have a look at the traffic and determine what type of traffic it is. I bet we have people in that office just watching video of the CEO from the HQ. I have enabled IP NBAR on the serial and Ethernet interfaces and have noticed that 70% of the traffic, is unclassified. How can I view this data to just get then router to tell me the IP source and the port number associated with this traffic? I also would like to put down a quality of service map for known business applications, and grant them priority over any other traffic. Has any one done this and if so can you send snippets of your config or link to doco's Thanks all for your help John Sydney Australia ** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.solution6.com ** **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=73499&t=73495 -- **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
RE: traffic flow [7:73495]
There a few free NetFlow 'servers' - have a look at cflowd at http://www.caida.org/tools/measurement/cflowd/ This is how they describe it - "cflowd is a flow analysis tool currently used for analyzing Cisco's NetFlow enabled switching method. The current release includes the collections, storage, and basic analysis modules for cflowd and for arts++ libraries. This analysis package permits data collection and analysis by ISPs and network engineers in support of capacity planning, trends analysis, and characterization of workloads in a network service provider environment. Other areas where cflowd may prove useful include usage tracking for Web hosting, accounting and billing, network planning and analysis, network monitoring, developing user profiles, data warehousing and mining, as well as security-related investigations." HTH, Dom Stocqueler SysDom Technologies Visit our website - www.sysdom.org -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: 11 August 2003 12:02 To: [EMAIL PROTECTED] Subject: RE: traffic flow [7:73495] That's what i said, use a ws with SNIFFER in between, INSTANT graphs. Martijn -Oorspronkelijk bericht- Van: Doan Nguyen [mailto:[EMAIL PROTECTED] Verzonden: donderdag 7 augustus 2003 22:11 Aan: [EMAIL PROTECTED] Onderwerp: RE: traffic flow [7:73495] Netlfow would be your best way of doing this but you will need a netflow server and I think that costs additional money. AFter that you would need to write scripts to parse out the netflow data, because it's not pretty to look at. ip accounting is a quick and intrusive way to do accounting of ip traffic but it is stresful to your router and would only give you the biggest IP pair talker. **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=73869&t=73495 -- **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
RE: traffic flow [7:73495]
That's what i said, use a ws with SNIFFER in between, INSTANT graphs. Martijn -Oorspronkelijk bericht- Van: Doan Nguyen [mailto:[EMAIL PROTECTED] Verzonden: donderdag 7 augustus 2003 22:11 Aan: [EMAIL PROTECTED] Onderwerp: RE: traffic flow [7:73495] Netlfow would be your best way of doing this but you will need a netflow server and I think that costs additional money. AFter that you would need to write scripts to parse out the netflow data, because it's not pretty to look at. ip accounting is a quick and intrusive way to do accounting of ip traffic but it is stresful to your router and would only give you the biggest IP pair talker. **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=73863&t=73495 -- **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
RE: traffic flow [7:73495]
Netlfow would be your best way of doing this but you will need a netflow server and I think that costs additional money. AFter that you would need to write scripts to parse out the netflow data, because it's not pretty to look at. ip accounting is a quick and intrusive way to do accounting of ip traffic but it is stresful to your router and would only give you the biggest IP pair talker. Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=73682&t=73495 -- **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
RE: traffic flow [7:73495]
Fast and direct graphs? Use the sysadmin way. Between router and hub/switch put a hub/laptop in between (or use span ofcourse) with sniffer software running.. for a few days. First check after a few hours that you see what you want to see. It'll give you anything you need in gui and more. Martijn -Oorspronkelijk bericht- Van: John Brandis [mailto:[EMAIL PROTECTED] Verzonden: dinsdag 5 augustus 2003 8:02 Aan: [EMAIL PROTECTED] Onderwerp: traffic flow [7:73495] Hey All, Got a question about traffic flow into and out of a branch office. I have a branch office with only a handful of users, but with high demands on the WAN. This particular office has a 256k/32k frame connection into me (the HQ) but a crying out for greater bandwidth and pipe access. What my problem is, is understanding how these users are using up all there network bandwidth. I have no access list in place between me and them (however I will be going down this road). Whats I want to do, is have a look at the traffic and determine what type of traffic it is. I bet we have people in that office just watching video of the CEO from the HQ. I have enabled IP NBAR on the serial and Ethernet interfaces and have noticed that 70% of the traffic, is unclassified. How can I view this data to just get then router to tell me the IP source and the port number associated with this traffic? I also would like to put down a quality of service map for known business applications, and grant them priority over any other traffic. Has any one done this and if so can you send snippets of your config or link to doco's Thanks all for your help John Sydney Australia ** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.solution6.com ** **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=73496&t=73495 -- **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
