Cisco Netflow Monitoring Advice

Hello Experts,
 
I'm in the process of trying to establish why our ATM link is becoming over utilised. The problem is I'm not sure what what interface I should be monitoring.
 
For example, the output below shows the interface information for  ATM 0/1/0, Dialer 1, Virtual-Access 2, and Tunnel 0.
 
Can you advice on the interface that I should monitor?
 
ATM0/1/0 is up, line protocol is up
  Hardware is MPC ATMSAR, address is 6073.5cd8.95a6 (bia 6073.5cd8.95a6)
  Description: Internet Connection
  MTU 1600 bytes, sub MTU 1600, BW 448 Kbit/sec, DLY 820 usec,
     reliability 255/255, txload 10/255, rxload 27/255
  Encapsulation ATM, loopback not set
  Keepalive not supported
  Encapsulation(s): AAL5
  4 maximum active VCs, 1024 VCs per VP, 1 current VCCs
  VC Auto Creation Disabled.
  VC idle disconnect time: 300 seconds
  Last input never, output 00:00:00, output hang never
  Last clearing of "show interface" counters 1d06h
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 10639
  Queueing strategy: Per VC Queueing
  5 minute input rate 48000 bits/sec, 10 packets/sec
  5 minute output rate 18000 bits/sec, 10 packets/sec
     5719399 packets input, 952942086 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     4993291 packets output, 1672459181 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out
 
 
uk01340-rm01-ald#show int dialer 1
Dialer1 is up, line protocol is up (spoofing)
  Hardware is Unknown
  Internet address is 80.xxx.xxx.xxx/30
  MTU 1500 bytes, BW 56 Kbit/sec, DLY 20000 usec,
     reliability 255/255, txload 1/255, rxload 204/255
  Encapsulation PPP, LCP Closed, loopback not set
  Keepalive set (10 sec)
  DTR is pulsed for 1 seconds on reset
  Interface is bound to Vi2
  Last input never, output never, output hang never
  Last clearing of "show interface" counters 1d06h
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: weighted fair
  Output queue: 0/1000/64/0 (size/max total/threshold/drops)
     Conversations  0/0/16 (active/max active/max total)
     Reserved Conversations 0/0 (allocated/max allocated)
     Available Bandwidth 42 kilobits/sec
  5 minute input rate 45000 bits/sec, 8 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     5708860 packets input, 929602766 bytes
     5004084 packets output, 1676830477 bytes
Bound to:
 
Virtual-Access2 is up, line protocol is up
  Hardware is Virtual Access interface
  MTU 1500 bytes, BW 448 Kbit/sec, DLY 20000 usec,
     reliability 255/255, txload 9/255, rxload 25/255
  Encapsulation PPP, LCP Open
  Open: IPCP
  PPPoATM vaccess, cloned from Dialer1
  Vaccess status 0x44
  Bound to ATM0/1/0 VCD: 1, VPI: 0, VCI: 38, loopback not set
  Keepalive set (10 sec)
  DTR is pulsed for 5 seconds on reset
  Interface is bound to Di1 (Encapsulation PPP)
  Last input 00:00:00, output never, output hang never
  Last clearing of "show interface" counters 1d06h
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 45000 bits/sec, 9 packets/sec
  5 minute output rate 17000 bits/sec, 9 packets/sec
     5719524 packets input, 930220408 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     5004088 packets output, 1676831301 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out
     0 carrier transitions
 
uk01340-rm01-ald#show interfaces tunnel 0
Tunnel0 is up, line protocol is up
  Hardware is Tunnel
  Description: ** mGRE/NHRP tunnel **
  Internet address is 172.17.142.121/24
  MTU 17912 bytes, BW 2048 Kbit/sec, DLY 50000 usec,
     reliability 255/255, txload 1/255, rxload 5/255
  Encapsulation TUNNEL, loopback not set
  Keepalive not set
  Tunnel source 80.xxx.xxx.xxx (Dialer1)
   Tunnel Subblocks:
      src-track:
         Tunnel0 source tracking subblock associated with Dialer1
          Set of tunnels with source Dialer1, 1 member (includes iterators), on interface <OK>
  Tunnel protocol/transport multi-GRE/IP
    Key 0x30D42, sequencing disabled
    Checksumming of packets disabled
  Tunnel TTL 255, Fast tunneling enabled
  Tunnel transport MTU 1472 bytes
  Tunnel transmit bandwidth 8000 (kbps)
  Tunnel receive bandwidth 8000 (kbps)
  Tunnel protection via IPSec (profile "vpnprofile")
  Last input 00:00:00, output never, output hang never
  Last clearing of "show interface" counters 1d06h
  Input queue: 0/256/0/0 (size/max/drops/flushes); Total output drops: 21327
  Queueing strategy: fifo
  Output queue: 0/0 (size/max)
  5 minute input rate 48000 bits/sec, 2 packets/sec
  5 minute output rate 5000 bits/sec, 3 packets/sec
     5694230 packets input, 500481747 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     4967869 packets output, 1658929974 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out
uk01340-rm01-ald#
 
Thanks it advance for you help?
 
Cheers
 
Carlton
cpatte7372Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

rauenpcCommented:
Couple thoughts.
You could monitor them all, and try to decipher afterwards which application is eating up all the bandwidth.
Monitoring the physical interface should give you all traffic, but if it is encapsulated in any way you won't know what the traffic is but rather only counters. Otherwise you would want to monitor whichever interface(s) traffic goes to to be encap/decapsulated.
Alternately, if you are not doing any hair pin routing on the WAN interface, you can always monitor the LAN interface to get an idea of who's doing what.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
rfalconersffcuCommented:
How have you determined that the link is over utilized?
0
cpatte7372Author Commented:
Cheers
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.