Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

how to find the top talker on a subnet

Posted on 2011-09-06
6
446 Views
Last Modified: 2012-05-12
this morning something on our core site network is sending out a large amount of traffic causing congestion. Multiple remote offices are complaining of poor response. We can see it on the mpls providers online tool that all available bandwidth outgoing to the remote sites has been maxed for a couple hours. A possible suspect, a windows update server was turned off but the problem persists. Whats the best way to find out what is generating all this traffic and why?
Just some background: we have multiple remote sites on an mpls with nothing filtered. There is a separate internet circuit that goes out from our core site that is not seeing any saturation. All the high utilization is going from the core site to the remote offices. Incoming traffic is low and normal. The internet circuit traffic is also low and normal. Not sure if I have provided enough info but Im trying to get another perspective on figuring out who is the top talker and why.
0
Comment
Question by:WAMSINC
6 Comments
 
LVL 25

Expert Comment

by:Ken Boone
ID: 36490873
You need to use net flow or something that will produce net flow "like" data to figure this out.  So if you own the routers - and the router supports net flow, you can download the free version of scrutinizer.  Configure the router to send net flow to scrutinizer and within minutes you will know who the top talker is.

If you do not own the main mpls router you can download ntop from ntop.org.  Load up this tool and plug it into the same switch that the core mpls router is on.  Then mirror the port the router is connected to to the port that the ntop machine is plugged into.  Again, you will see the top talker in a matter of minutes.
0
 

Author Comment

by:WAMSINC
ID: 36491115
unfortunately we do not have access to the routers. My workstation is plugged in to the same core switch, a cisco 6509. Looks like it was a kaspersky AV update server. This was causing congestion for almost 4 hours. I would like to still try this tool and be prepared for next time this happens. How can I mirror the mpls port on the core switch? or would that be another question/issue ?
0
 
LVL 25

Accepted Solution

by:
Ken Boone earned 500 total points
ID: 36491182
monitor session 1 source interface gig1/0/1
monitor session 1 destination interface gig1/0/2

Thats off the top of my head so the syntax might not be exact.  Just type in monitor session 1 ? and it will show you the options.

source interface is the device port we want to monitor.
destination interface is where we want the traffic mirrored to  - ntop device.

Hope that helps.
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
LVL 38

Expert Comment

by:ChiefIT
ID: 36512916
Use the Real Time Netflow Analyzer from solar winds/free tools:

http://www.solarwinds.com/products/solarwinds_free_tools/
0
 
LVL 25

Expert Comment

by:Ken Boone
ID: 36513323
He needs to be able to access the router to actually use net flow.
0
 
LVL 21

Expert Comment

by:Rick_O_Shay
ID: 36513447
You could mirror the port the router is on to a PC wrunning a Wireshark capture and then do a filter down to the subnet you want to look at.

Look in statistics/conversations and sort by the bps columns to see who is the heaviest hitters.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As companies replace their old PBX phone systems with Unified IP Communications, many are finding out that legacy applications such as fax do not work well with VoIP. Fortunately, Cloud Faxing provides a cost-effective alternative that works over an…
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question