Check bandwidth usage in Cisco Router

DP230 used Ask the Experts™
Dear Experts, we noticed that some times, the bandwidth of Router is high but not sure its reasons. How can we check which application or somethings are consuming the bandwidth in LAN network?

Cisco Router 3925, Core switch Cisco 3750/3560, Access switch Catalyst 500, 2960
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Cisco routers have a feature called "Netflow". This can be configured on the 3925 to send information about packets passing through the device to some other device or application that can parse and make sense of it all.

Here is some info on setting up Netflow:

And a couple of the many applications available to analyse it:

Wikipedia article on Netflow:
WissamSenior Network Engineer

Enabling ip nbar might be a fast approach as well
DP230Network Administrator


ok, thank you. how about "show ip flow top-talker"?
I use PRTG and it works quite nicely and is free for 100 sensors.  

It will measure bandwidth using SNMP to give you utilisation graphs.  This is useful, because you will be able to see at a glance where the bottleneck is - which interface, incoming/outgoing etc.  This was invaluable recently in spotting an SNMP attack on a router I manage.  The external interface graph showed spikes of outbound data, but there was no corresponding data on the internal interfaces.  

Then set up the netflow sensor for interface(s) that have the traffic you want to diagnose.  

Top TIP, if you are using NAT, use Netflow V9 on the Internal interface and do ingress AND egress (you don't normally do Egress monitoring).  This will avoid the IP of the switch being used for all incoming data.  If not using NAT, set up ingress on all interfaces you feel are relevant and you'll see all data passing through the router.

You might also want to make use of the cisco SNMP health sensor.  It will graph CPU and RAM usage.  I have had instances where I thought bandwidth was being saturated, but in actual fact, there was spare bandwidth, but the CPU was maxed out.  

It is useful to have CPU, RAM, Per interface bandwidth and Netflow graphs in the same app so you can correlate issues with the time that they happen.

I think between us we covered what was needed to set up usable monitoring

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial