troubleshooting Question

Cisco Interface Saturation - Top Talker Script Interpretation

Avatar of cpatte7372
cpatte7372Flag for United Kingdom of Great Britain and Northern Ireland asked on
Routers
5 Comments1 Solution543 ViewsLast Modified:
Hello Community,
 
We've been experiencing high utilisation on our interface, to the point where the rx is full saturated, see below:
 
ukxxxx-rm01-xx#show int atM 0/1/0
ATM0/1/0 is up, line protocol is up
  Hardware is MPC ATMSAR, address is 6073.5cd8.95a6 (bia 6073.5cd8.95a6)
  Description: Internet Connection
  MTU 1600 bytes, sub MTU 1600, BW 448 Kbit/sec, DLY 820 usec,
     reliability 255/255, txload 137/255, rxload 255/255
 
 
I decided to apply the attached script to determine what might be causing the saturation. I have also attached an explanation of how the script works.
 
Can someone please help me interpet the output?
 
The culprit is the source ip 194.75.x.x to 80.229.x.x with prot ESP and AvgBits/s 1.19M and AVGpkt/s 175.
 
I don't know how to interpret the results...
 
Any explanation would greatly appreciated.
 
Cheers
 
Carlton
netflow-output.txt
top.txt
INSTALL.txt
README.txt
Join the community to see this answer!
Join our exclusive community to see this answer & millions of others.
Unlock 1 Answer and 5 Comments.
Join the Community
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 5 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros