From owner-freebsd-isp  Wed Jan 16  7:54:49 2002
Delivered-To: freebsd-isp@freebsd.org
Received: from cody.jharris.com (cody.jharris.com [205.238.128.83])
	by hub.freebsd.org (Postfix) with ESMTP id 1697B37B400
	for <freebsd-isp@FreeBSD.ORG>; Wed, 16 Jan 2002 07:54:44 -0800 (PST)
Received: from localhost (nick@localhost)
	by cody.jharris.com (8.11.1/8.9.3) with ESMTP id g0GFtHg12888;
	Wed, 16 Jan 2002 09:55:17 -0600 (CST)
	(envelope-from nick@rogness.net)
Date: Wed, 16 Jan 2002 09:55:16 -0600 (CST)
From: Nick Rogness <nick@rogness.net>
X-Sender: nick@cody.jharris.com
To: Chris Shenton <chris@shenton.org>
Cc: freebsd-isp@FreeBSD.ORG
Subject: Re: Who's saturating outbound link (Cisco 2620, IOS 12.1(1))
In-Reply-To: <87g05a2ao2.fsf_-_@thanatos.shenton.org>
Message-ID: <Pine.BSF.4.21.0201160954460.12818-100000@cody.jharris.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-isp@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-isp.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-isp>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-isp>
X-Loop: FreeBSD.org

On 13 Jan 2002, Chris Shenton wrote:


	Search cisco's site on enabling NetFlow statistics.

> An ISP I support has FreeBSD servers and a bunch of LAN- and
> ISDN-connected clients.  Its remote so I can't get to it physically.
> 
> In the past couple days, the 256Kbps link has been totally saturated,
> MRTG tells me it's outbound traffic.   How can I determine which
> system is causing the traffic?
> 
> I'm not a Cisco expert, but hoped "show ip accounting" would help, but
> it only appears to show me *inbound* traffic from all outside
> addresses to my internal addresses.  I need the opposite.  Is there
> some IOS command I'm just not clued into? 
> 
> I'm working with the remote admin to see if I can get a hub put
> between the router and other ISP gear, then put a FreeBSD box on that
> so I can use tcpdump or others to sniff the traffic.  Until then, I'm
> blind unless there's some cisco voodoo I can use.
> 
> Any ideas? Thanks.
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-isp" in the body of the message
> 

Nick Rogness <nick@rogness.net>
 - Don't mind me...I'm just sniffing your packets


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message