Measure / Analyze traffice on a 17xx router

Hi,
I've got a cisco 17xx router with a 2MB connection and some branch offices connected with VPN tunnels to this router.
Since a few days we have some annoying delays.
Since the router is the only device between the LAN and the internet, what commands can I use to analyze the traffic going to the router?
Regards,

Enable NetFlow on the router: in config mode, enter "ip cef" to enable Cisco Express Forwarding on the router, and "ip route-cache flow" on the interfaces.
From the command line interface, "show ip cache flow" will show you in real-time the active flows across your router. Keep in mind that the protocol ("Pr"), source port ("SrcP") and destination port ("DstP") will be listed in hexadecimal.
For example, protocol 11 in hexadecimal is really protocol 17 in decimal, which is UDP; 06 in hex is 06 in decimal, which is TCP; and 01 in hex is 01 in decimal, which is ICMP.
Similarly, port 0019 in hex is port 25 in decimal, which is SMTP; port 0035 in hex is port 0053 in decimal, which is DNS; and port 0050 in hex is port 0080 in decimal, which is HTTP.
If you enable NetFlow Data Export to a computer that is running a program such as
ManageEngine™ NetFlow Analyzer 4
http://manageengine.adventnet.com/products/netflow/
you can not only track your bandwidth usage over time, you can also drill down and see exactly what you're doing with that bandwidth, where your users are going, when they went there, etc. And the application converts the hex to decimal for you, so it's easier to interpret.

Similar Messages

  • Measure telephone traffic on an ISDN PRI

    Has anyone developed an EEM Scrip to measure telephone traffic on an ISDN PRI interface on a voice gateway?  Preferably the traffic measurements would be in Hundred Call Seconds (CCS) or Erlangs. It would appear that the “show isdn service” command could be used to determine the state of the individual “B” channels on the PRI.

    If the "show isdn service" command gives you what you want, then you could build a policy using the timer event detector (watchdog timer) to run the command periodically and produce the desired reports.  I don't know of anyone that has already done this, though.

  • ACLs never apply to traffic generated by the router

    http://www.ciscopress.com/articles/article.asp?p=174313&seqNum=4&rl=1
    "Another special note on Cisco ACLs is that ACLs never apply to traffic generated by the router. So, even if you have an inbound and an outbound ACL on a router denying all traffic, the router will still be able to send any packet it wants; the return packet, however, will be blocked as usual".
    Is it (the return packet, however, will be blocked as usual) the case all the time ? if it is the case could you please explain ?

    Thanks Rick,,,I need some clarification about the below scenario please:
    suppose I have got R1 (one of many routers) with two interfaces serial0/0 and e0/0,,,the ip address for serial0/0 192.168.0.1/24
    the ip address for e0/0 172.16.0.1/16.
    R1(config)=access-list 101 deny ip any any
    R1(config)#interafec serial 0/0
    R1(config-if)#ip access-group out
    R1(config)=access-list 150 deny ip any any
    R1(config)#interafec fastethernet 0/0
    R1(config-if)#ip access-group in
    Now we satisfied the condition which it says: "where there is an outbound ACL and an inbound ACL and they both deny all traffic".
    1- ((The inbound ACL will deny all traffic)).
    This is obvious because any packet trys to enter the router R1, the ACL will check both ip addresses for the source (any) and destination (can be one of the interfaces belong to R1),,,,because it match the condition for ACL, it will be dropped.
    2- ((In this case the outbound ACL can deny transit traffic, but can not deny packets generated by the router which will be transmitted)).
    This first paragraph (In this case the outbound ACL can deny transit traffic) is fine,,,the second one which is : " but can not deny packets generated by the router which will be transmitted",,,,,,,my understanding is this when packets generated by router R1, these packets have got source ip address and destination ip address.
    The source and destination ip addresses still matching the condition of ACL , why should't it be
    denied ?

  • Regular NetFlow or FNF shows less traffic stats on Cisco router

    I have configured my cisco router to export regular NetFlow packets by enabling ingress on all the interfaces, I am getting very less traffic in Analyzer tool. Then I enabled egress alone on all the interfaces, it shows again less traffic.
    There is huge differnce when we compare router stats and NetFlow export stats. Then also enabled FNF, both input or output monitor still the same.
    Any solution will be appreciated !!!
    I have attached the Show version and Config with this thread.

    Hey Nick,
    The tricky part is getting the alert from consumed bandwidth. That will be handled from your NMS software of course. To answer your questions-
    #1 - You can use the interface OID in MIB-II. There may be a specific MIB on the 3G, but MIB-II should work just fine. You can check on the 3G MIB here: http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en
    #2 -  I think that would work. You would flow only your interface and send that to NMS. During an outage the router will hold the Netflow data, but I don't think it can push old stats after the primary link comes online. It would probably work if the outage was short but if it was longer, you would have to jump in the CLI and view the data there. I would lab it up, but I don't have any Netflow software

  • ISCSI boot with Intel NICs added to windows 2008 r2 routing table causes non iscsi traffic to attempt default routes on iscsi networks

    I have a server with Intel 82576 Gigabit Dual Port Nics.  I have configured them to use iSCSI boot the primary looks to 10.0.0.1/24 and the secondary looks to 10.0.1.1/24.  The target is configured correctly.  Everything boots as expected.
     I have added the MPIO feature and configured MPIO for the iscsi initiator as per: http://blogs.technet.com/b/migreene/archive/2009/08/29/3277914.aspx.
     My issue is that the iSCSI networks show up in the routing table like so:
    I did not configure a default route in the Intel setup utility:
    I tried to explicitly remove the 0.0.0.0 entry and leave blank, with no change.  As you can see with the above routing table traffic attempts to travel over these routes:
    C:\Users\Administrator>ping google.com
    Pinging google.com [209.85.145.99] with 32 bytes of data:
    Reply from 10.0.0.201: Destination host unreachable.
    Reply from 10.0.1.201: Destination host unreachable.
    Reply from 209.85.145.99: bytes=32 time=23ms TTL=51
    Reply from 209.85.145.99: bytes=32 time=22ms TTL=51
    Ping statistics for 209.85.145.99:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
    A ping to the outside world first attempts on 10.0.0.x/24 network, then on 10.0.1.x/24 network and then finally on the network the traffic should go over.  I don't want my iSCSI traffic to ever show up with a default route.  How do I get rid of it?
    route delete 0.0.0.0 mask 0.0.0.0 "on-link" results in: The route deletion failed: The parameter is incorrect.
    route delete 0.0.0.0 mask 0.0.0.0 on-link results in: The route deletion failed: The parameter is incorrect.
    route delete 0.0.0.0 deletes all default routes, then I have to add back in the "valid default route" of 192.168.100.6.
    I would like to not have to do a route delete though.

    So I've sort of given up on fixing the gateway assignment in the route for iSCSI boot.  I configured a DHCP server to give out the information required by iSCSI boot and configured the network cards to use DHCP for their configuration.  I insured
    that my DHCP server gave out no default gateway entry.  However, I still got the undesired routes in the routing table.  This makes me assume that there isn't a "fix" for it, only the workaround.
    Here is the script I run on each iSCSI Boot initiator (you would obviously change the ip number to suit your environment):
    @Echo off
    Rem fixes iscsi route problem as shown below:
    Rem IPv4 Route Table
    REM ===========================================================================
    REM Active Routes:
    REM Network Destination Netmask Gateway Interface Metric
    REM 0.0.0.0 0.0.0.0 On-link 10.0.0.200 10255
    REM 0.0.0.0 0.0.0.0 On-link 10.0.1.200 266
    REM 0.0.0.0 0.0.0.0 192.168.100.6 192.168.100.98 266
    REM The top 2 lines are on the iscsi interface and traffic tries to go out it
    REM We need to delete the routes, so we'll just delete all gateway routes and
    REM add back in the one we care about.
    route delete 0.0.0.0 >c:\iscsibootroutefix.log
    route -p add 0.0.0.0 mask 0.0.0.0 192.168.100.6 >>c:\iscsibootroutefix.log
    After running it I get:
    IPv4 Route Table
    ===========================================================================
    Active Routes:
    Network Destination Netmask Gateway Interface Metric
    0.0.0.0 0.0.0.0 192.168.100.6 192.168.100.98 11
    10.0.0.0 255.255.255.0 On-link 10.0.0.200 10255
    10.0.0.1 255.255.255.255 On-link 10.0.0.200 10255
    10.0.0.200 255.255.255.255 On-link 10.0.0.200 10255
    Then I added a task in “task scheduler” of "administrative tools"  that ran as the user “system” “when the computer starts” that runs this script.

  • Cisco 7609 router received higher traffic than upstream provider router is sending

    Hi all,
    I have a Cisco 7609 router that connects to our upstream provider router using 3rd party DWDM Fiber backhaul provider.
    The upstream provider router is a Juniper router that had capped our port speed to 1.1Gbps, the backhaul provider didn't capped our port speed and the maximum speed is 2Gbps since it's a 2x1Gbps port channel interface.
    I have noticed that our 7609 router able to receive traffic that exceeds 1.1Gbps, and the highest traffic able to received is 1.3Gbps and more.
    I have crossed checked the MRTG graph provided by our upstream provider as well as our PRTG graph and indeed we are receiving higher bandwidth than our upstream provider is sending.
    I'd like to know if anyone know how it is possible to receive traffic that is higher than what the neighbor router is sending?
    Regards

    Hi at all,
    We found a solution for this Problem !!
    We always and always got this error:
    %PQUICC-1-LOSTCARR: Unit 0, lost carrier. Transceiver problem?
    The problem was the cable! The following pin-out is required:
                                            1 ----- 1
                                            2 ----- 2
                                            3 ----- 6
                                            4 ----- 5
                                            5 ----- 4
                                            6 ----- 3
                                            7 ----- 7
                                            8 ----- 8 
    We used this and the fault has disappeared!!
    The only problem that still exists:
    After the first connection the router must be rebooted because otherwise no more additional session is established.
    Thanks for all answers.
    Regards,
    Mario

  • Analyzer Traffic Light Issue

    Version 5.0.0.10045It seems that the traffic light works with only one formula, either down the column or accross the row on the same sheet (tab). I need a different formula for each single cell. If I show sales this year over last with a variance, I want the variance to show a green light over 4.99%, and if it less than 0%, a red light. I can do the latter. I also want to show gross profit percent, this year over last year with a variance. I want the GP variance to show a green light over .24%, and if it is less than 0%, I want it to show as a red light. BOTH FORMULAS ON THE SAME SHEET. ONE MEMBER (Sales) UNDER THE OTHER MEMBER (Gross Profit).If this can be done, your info will be appreciated.WSB Home Furnishing Corp.email: [email protected]

    I tried to replicate the issue you're describing and could not. The first thing you should do is download the latest patch. Hyperion is currently at Analyzer 5.0.3. There were some traffic lighting and formatting enhancements from the version you are running. If this does not help I would contact support and open a case.

  • Measuring Network Traffic

    Hi friends,
    What's the difference between measuring by(bytes or packets)?

    No, you have the client, there i need the total traffic caused by that client. That must be send to the server together with the windows logon name.
    On the server, he reads the information that he gets from the client (like every 5 minutes or something) and that he puts in a hashtable.
    When the client logs out, there must be a final update to the server with the latest stats and an extra status parameter that says the user is going offline. Then the server updates his hashtable first, reads the final data for that user, puts it in the database and then delete that user (session) out his hastable.
    So in fact, i just need to know how i can get access to the traffic on the client side.

  • Measure network traffic

    I want to measure the whole internet traffic comming in or out of my eri/hme etc. in kb/s|mb/s. As I don't want to install any tools like net-snmp, mrtg, or other net traffic counter, I'm wondering if there is a basic unix command.
    I appreciate any help
    Cheers, Martin

    Hi,
    To complement my answer you may also want to try out
    kstat -n [ ip | icmp | stcp |  tcp | udp]
    and/or
    netstat -s
    Hope this helps,
    -- daniel
    JMX, SNMP, Java, etc...
    http://blogs.sun.com/roller/page/jmxetc
    PS: Note that Java DMK 5.1 (http://java.sun.com/products/jdmk/index.jsp)
    has an example (called SolarisKstat)
    which works on solaris - and will generate an MBean which will be
    able to get at the data exported by a kstat module through JNI.
    So in principle you could also use Java SE 5.0, JMX, and JDMK
    to export your kstat data to a remote manager.
    The example is a little raw, and I am not completely sure on which
    solaris version it was last tested....

  • Traffic info covered by route in Maps

    In the new Maps in iOS 5, the route is covering the traffic information.  How can I make the route a bit transparent (like it was in previous version) or at least turn off and on the route to see the traffic info?

    Bump.  Living in LA, the Maps app is one of my most used app because of the traffic information.  With the route overlayed on the traffic info, this is almost useless unless I take out the route everytime.  I hope this gets fixed!

  • Filtering traffic on a 2621 router

    Hi,
    i'm doing some project for school and now i'm stuck...
    (I study Network Infrastructure Design in the Netherlands)
    I'm trying to control who may gain access to my network and who not using a 2621Router and two catalyst switches (2924 and 3524XL).
    Macfiltering using portsecurity on the switch seemed nice but unfortunately this works only if only one computer is connected to one port. however in my scenario there is a switch (which isn't cisco) connected to a port where multiple users are behind (say 4).
    Another option is using dhcp with leases binded to macaddresses, but an ip address is to easy to setup manual on a pc.
    Is there a way to control on the router (so not on the switch) which macaddress may be routed? Or some simple program which does the same as URT with userauthentication based on macaddress.
    I hope my question is clear, it's hard to explain what i want, cause i don't know it myself for 100%
    Thanks,
    Niels

    Yes i am able to configure the list, only when i go to the interface i can choose out the following:
    Router(config-if)#ip access-group ?
    <1-199> IP access list (standard or extended)
    <1300-2699> IP expanded access list (standard or extended)
    WORD Access-list name
    My created acl has the number 1100 since that is the Extended 48-bit MAC address access list. (as shown below)
    Router(config)#access-list ?
    <1-99> IP standard access list
    <100-199> IP extended access list
    <1000-1099> IPX SAP access list
    <1100-1199> Extended 48-bit MAC address access list
    <1200-1299> IPX summary address access list
    <1300-1999> IP standard access list (expanded range)
    <200-299> Protocol type-code access list
    <2000-2699> IP extended access list (expanded range)
    <300-399> DECnet access list
    <600-699> Appletalk access list
    <700-799> 48-bit MAC address access list
    <800-899> IPX standard access list
    <900-999> IPX extended access list
    rate-limit Simple rate-limit specific access list
    My IOS version:
    IOS (tm) C2600 Software (C2600-D-M), Version 12.0(7)T, RELEASE SOFTWARE (fc2)

  • WRE54G Cannot route traffic

    Hi all,
    My WRE54G version 2 cannot route the WIFI traffic to my Belkin router after setup. The setup was made by connecting the WRE54G directly to Belkin router with the following configurations with the Web configuration tool in WRE54G.
    WRE54G
    Name: Linksys WRE54G
    IP address: 192.168.1.150
    Subnet Mask: 255.255.255.0
    Gateway: 192.168.1.1
    Mode: Mixed
    Channel: 10
    SSID: 54Home
    Wireless Security: Enable
    Belkin Router
    IP Address: 192.168.1.1
    Subnet Mask: 255.255.255.0
    DHCP Address range: 192.168.1.2 - 192.168.1.100
    Mode: Mixed
    SSID: 54Home
    WEP setting of both Belkin router and WRE54G are the same.
    Both the link and activity LED on the WRE54G are Lighted in blue.
    When connecting WRE54G with UTP wire, I can ping the WRE54G with my notebook with wired connection with Belkin, and I can use the web interface configure the WRE54G. When removing the wire to WRE54G, the notebook cannot ping the WRE54G.
    When I test the WRE54G with wireless connection, my notebook cannot get an IP address and it needs to manually assign one. After using the manual IP, the notebook can reach the WRE54G, but not the Belkin Router, nor any connection to the internet.
    However, if I disable the wireless network of the notebook and connect it directly to the router with UTP wire, the router is working fine. I switch off the WRE54G, change the notebook to DHCP, it connect back to the Belkin router and internet contivity is also fine.
    It seems that the WRE54G did not talk to Belkin on the WIFI traffic. Are there anyone encountered the same problem, and have the solutions?
    Thanks in advance
    Davis

    Make sure that wireless settings are same as in wireless router also check the Ip settings in the range extender ... it should be in the range of the router .... If all settings working fine .... & still you are not able to ping the Range Extender when wireless .... Disable the firewall on the laptop for few seconds .... try to ping the Range Extender .... if not ... in such case ... upgrade the firmware of the range Extender ...after upgrade ... reset & reconfigure the router ...

  • Routing unit of measure conversion

    Dear guru ,
    I have a different unit of measure for one operation of my routing.
    Which is the problem if I maintain relation 1 to 1 in the routing unit of measure conversion ?
    Thanks.

    Dear  ,
    One operation of my routing have a different unit of measure (EA for operation , KG for routing).
    I don't know the exact conversion factor between operation and routing.
    This factor is only known after the confermation of the production order.
    Which problem occurs if i maintain relation 1 to 1 (numerator and denominator) in the routing unit of measure conversion.
    Thanks.

  • Traffic policy in pps for through the router data

    Hello. I need to construct an inbound traffic policy for a router to limit pps. The traffic is actually through the router traffic destined for hosts further in the network. What I am seeing is that pps can only be applied to control plane policies and control plane policy, as I understand it, is for to the router traffic (BGP etc). Is there another way to do this or am I incorrect in my understanding of the control plane? I am working with an ASR 1002. Thanks.

    In case you're interested I explain how the MAX DECODE approach works, with step by step examples, in my new Rows to Columns tutorial series.
    Joe Fuda
    SQL Snippets

  • How to measure network logon traffic by clients

    Hi,
    We want to understand what network logon traffic is generated by various clients on a physical network.  Is there a way to measure this traffic which includes items like group memberships, GPOS, logon scripts, offline folders, etc.  We have
    a large international AD deployment and understanding network logon traffic would be beneficial.
    Thanks for your help! SdeDot

    Hi,
    For that you have to run Network monitor.
    http://blogs.technet.com/b/mrsnrub/archive/2009/09/10/capturing-network-traffic-in-windows-7-server-2008-r2.aspx
    http://blogs.msdn.com/b/canberrapfe/archive/2012/03/31/capture-a-network-trace-without-installing-anything-works-for-shutdown-and-restart-too.aspx

Maybe you are looking for