Solved

Need to see traffic across WAN

Posted on 2010-08-25
4
265 Views
Last Modified: 2012-05-10
We have a Point-2-Point T1 that supplies a 1MB connection between two LANs.  The T1 is wide open for both networks so traffic can come across the T1 at any time for any reason.  DHCP helps to control access by passing out local gateway, DNS and other domain traffic.  However there are times when we have a wild node that gets relocated to the opposite office or maybe a wrong DHCP entry.  Either way, we end up with 3000ms response time across the T1 when you normally see 10ms.  The challenge is that I currently have no quick way to see what node is sending/receiving traffic across that link.  The T1 is terminated into a radio broadcast device that does nothing more than give it a switch port, so there is no monitoring on either end.

With all of that said, I would like to be able to install a computer at one end of the T1, maybe place a 10/100 HUB inline with the T1 before it hits the local switch.  The computer could sniff the traffic to see what IP is sending/receiving a large majority of traffic.

Is this the best and cheapeast solution and if so, what software is free that will do this for me?  
0
Comment
Question by:murryc
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 8

Assisted Solution

by:jimmyray7
jimmyray7 earned 250 total points
ID: 33525976
Wireshark will let you see all of the traffic traversing the WAN.  It's pretty much the gold standard for this kind of stuff.

0
 
LVL 9

Accepted Solution

by:
asawatzki earned 250 total points
ID: 33526039
Here is what I would suggest.  Not sure what switch gear you have there, but if it is Cisco you can do the following:

1.  Plug in a desktop to the switch your WAN is plugged into on either site.
2.  Install wireshark's free Packet Sniffer.  http://www.wireshark.org/
3.  Find the switch interface that your WAN is plugged into on the remote network (or on your local network).  Turn on port mirroring on the interface your WAN is connected to so that it mirrors traffic over to the port your desktop is on.
4.  Turn on the packet capture for Wireshark on the desktop and you should be capturing all the traffic that is passing over the WAN.  You can use the Show IP Conversations view to see what end-to-end traffic is eating up all of your bandwidth.

If you don't have Cisco there may be another command like port mirroring for step 3.
0
 
LVL 2

Expert Comment

by:texasjpm
ID: 33526240
If you have a Cisco router I think i would use Flow-top-talkers. Here is an example of the config i am using.

interface GigabitEthernet0/0
 ip flow ingress
 ip flow egress

ip flow-export source GigabitEthernet0/0
ip flow-top-talkers
 top 10
 sort-by bytes
 cache-timeout 1300
 match input-interface GigabitEthernet0/0


cap.jpg
0

Featured Post

Simple, centralized multimedia control

Watch and learn to see how ATEN provided an easy and effective way for three jointly-owned pubs to control the 60 televisions located across their three venues utilizing the ATEN Control System, Modular Matrix Switch and HDBaseT extenders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I'm a big fan of Windows' offline folder caching and have used it on my laptops for over a decade.  One thing I don't like about it, however, is how difficult Microsoft has made it for the cache to be moved out of the Windows folder.  Here's how to …
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Suggested Courses

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question