Monitoring VLAN traffic

I moved from 2500 series routers to a switched network using a Catalyst 3750 and 3560 switches over the course of the last year. In my routed network I used MRTG to monitor traffic on my interfaces. In my switched network environment I have not been able to find a free or low cost tool that will monitor VLAN traffic. Any suggestions?

I have the same problem and found these links that provided answers:
http://forums.cacti.net/about29656.html&highlight=
http://www.experts-exchange.com/Hardware/Networking_Hardware/Switches/Q_23738165.html
Vlans on 3560s, 3750s and 3550s do not show stats. The packets are forwarded with the ASIC chips and do not cross the CPU for actual processing. To actually see the traffic you will need to turn off CEF, which decrases the performance significantly (not recommended, see links above).

Similar Messages

How to monitor VLAN trffic

I want to Monitor Vlan traffic
some of our equipment is not supported SNMP.
so all our customer gateway is defined in NoC L3 swith
as a differnt VLAN
when ever we try to take MRTG from L3 it shows vlan traffic is 100bits/sec but this customer is geetiing 2 MB/sec
how can we monitor any idea or help

As far as I'm aware (at least on the layer 3 switches I've dealt with) you can't get per-VLAN throughput statistics by monitoring SVIs/VLAN interfaces.
If you want per-VLAN stats (assuming you're trunking multiple VLANs over a single interface and want the stats for one VLAN) you may be able to poll the CISCO-CLASS-BASED-QOS-MIB if you're using policies on your physical interfaces.
I haven't found another way to obtain per-VLAN stats - I'd be happy to be corrected.
Of course it may be viable in your situation (depending on the connectivity) to simply monitor the physical ports to which customer routers are attached. (or maybe not, hence your VLAN question)

VLAN Traffic Monitoring

Hi all
I have a 2900XL core switches which in turn connected to several 2950 switches. All are connected to VLAN 1.
I have a few questions:
When people say broadcast traffic should not be more than 20% of the VLAN traffic.
1. Does it mean the broadcast of a single port in the 2950 switch or the core switch ?
2. How do i know the VLAN traffic ?
Any tools etc and how is the setup?
Hope comeone can help. :)
Thanks in Advance.
Alan

Hi Narayanan,
This is Guru Prasad.R from Saksoft Ltd. I am working as Network Engineer for past 1 year here. Also i had worked as part-time technical assistace in Networking Environment for 3 years too.
Since, i am new guy to this networking world i may require your guidance, support for making my career the best one.
I had finished my CCNA & 2-MCP exams one for Server 03 & another for Exchange Server 03. Also currently i doing with CCNP-Switching[BCMSN] exam.
Kindly help me to make my career the best one. Expeting your kindness on the same.
I had noted down ur contact number in Cisco profile. Below given my contact details:
Guru Prasad.R
Mobile: +91-9840822258
Mail id: [email protected]
Expecting your reply mail for the same.
Thanks & Regards,
Guru Prasad .R

Wireshark capture on access port displays different vlan traffic

Hi Guys,
i have a nexus 4001i Blade Center Switch where i have a server connected in mode access to a particular vlan.
when i use wireshark on this port, i see different traffic conversations of different servers in different vlans which seems strange to me.
anybody have an idea why a server in mode access with wireshark is able to view different vlan traffic? I also see non multicast and non broadcast converations.
the port the server is connected to is not a monitor port but only in switch port mode access.
thanks in advance for you feedback

Hi,
So it looks like you're getting unicast traffic flooded to all ports. There are a couple of reasons I've come across that can cause this.
Asymmetric routing: See Unicast Flooding in Switched Campus Networks and/or Case Study #8: Asymmetric Routing and HSRP (Excessive Flooding of Unicast Traffic in Network with Routers That Run HSRP) for details of why it happens and how to prevent it.
Microsoft Network Load Balancing. As per the Microsoft Troubleshooting NLB:
In unicast mode (the default Forefront TMG cluster operation mode) NLB induces switch flooding, by design, relaying packets sent to the VIP addresses to all cluster hosts. Switch flooding is part of the NLB strategy for obtaining the best throughput for any specific load of client requests. However, if the NLB interfaces share the switch with other (non-cluster) computers, switch flooding can add to the other computers' network overhead by including them in the flooding and consequently have a detrimental effect on network and/or server performance.
Regards

How to monitor network traffic on an IP alias?

Does anybody happen to know how I can monitor the traffic on an IP alias on say igb0:1 using iftop or something similar? iftop (pcap, I guess is the issue here) doesn't seem to cope with IP aliases.
Cheers

After fiddling around a bit with this issue I decided that it was time to embrace dladm/ipadm a bit more and exchange these old-style virtual NICs with new ones. So I dumped the old igbx:y VNICs and created new ones by issuing:
dladm create-vnic -l igb0 vnic0
followed by:
ipadm create-ip; ipadm create-addr…
Now, I can monitor these new vnics using if top just fine.

Is there anyway to monitor network traffic on the newer Time Capsules, similar to the SNMP monitoring previously?

Is there anyway to monitor network traffic on the newer Time Capsules, similar to the SNMP monitoring previously?

Can I use a real router and still have the Time Capsule for backups etc?
Yes, that is what Bridge Mode is for. Just connect the Time Capsule to a LAN <--> Ethernet port on your "main" router.

Vlan traffic is not passing through Wireless Bridge

Hi,
Recently we have placed wireless bridge in our network (Cisco AIR-BR1410A-E-K9 model). Now after installing the bridge we are facing the issue like only the management interface traffic is reachable through bridge, but not able to reach other vlan traffic.
like management range is in vlan 1 (which inlcudes AP' Switch and router) and the bridge IP's are also in Vlan 1.
Switch port is kept in trunk mode both ends of bridge. still other vlan traffic is not reachable, do we have to place any special configuration for this ?
all the business users are in Vlan 3
all the sale team users are in vlan 123.
now problem is other end switches are reachable for me through bridge that is in vlan 1, but vlan 3 and vlan 123 are not reachable for me.users are not getting IP's, when we assigned the static ip address and tested still it is not working.
i am attaching my wireless bridge configuration in the discussion, please help on this issue.
Root Bridge ---- Non--Rootbridge--- Cisco Switch--Cisco Switch..
now i am able to those two switch also, but not able to reach the vlan 3 users who are connected to that switches.

Hi,
infrastructure-ssid has been placed at both end still not able to get IP's to the devices.
I am not able to attach txt files in the reply, could you please let me know your email ID so that i will send the config files to your ID.

SA540 - Monitor Web Traffic (How to)?

Just as the title reads, I'm looking for a way to monitor what traffic is going through my SA540. Looking for what websites are being accessed.
Not sure how to do this. Can anyone assist?
Thanks in advance!

I looked into OPENDNS several months ago and seems like it was kinda expensive for commercial usage. It wasn't an option.
I was looking at the Status/Reports section of my 540 and it sounds like it gives the top 10 websites visited. Does this sound correct?
Of course Content Filtering must be turned on. I assume turning on Content Filtering does nothing until allowed or blocked URL data is present?
k

Monitoring interface traffic

I'm using a solution to monitor the traffic passing through the interface
SWCORE connecting with my router.
The Linux machine (sniff) has two interfaces (eth0 and eth1)
Etho (manages the machine) connected to the interface to another interface g1/18
(Sniff) connected in g1/27.
Add the following command:
monitor session 2 source interface Gi1/48
monitor session 2 destination interface Gi1/27
But I don't capture nothing.
I show monitor out following:
Session 2
Type : Local Session
Source Ports :
Both : Gi1/48
Destination Ports : Gi1/27
Encapsulation : Native
Ingress : Disabled
Learning : Disabled
Do what doing wrong? Help me??

try this "monitor session 2 source interface Gi1/48 ?"
Doesn't if show an option to span ingoing, outgoing or both traffic directions?
I think you need both
Do you see traffic on the spanport Gi1/27 if you do a "show interface Gi1/27" ?
The counters should go up
The interface Eth0 should be in promiscuous mode to capture the traffic other then for its own mac address or broad/multicast
Cheers,
Michel

Monitoring VNC traffic

Anyone know of an area where information on monitoring VNC traffic would be?
I have been asked to monitor VNC traffic and the baseline signature I have loaded
on devices seems a little lacking in scope....
Anyone else looking at this traffic on their network and can give some insight?
I didn't get alot of hits in the knowledge base when looking for VNC traffic so any
inforation can help.
Thanks...

I think mainly to see who is actually using or attempting to use VNC products...
Might be as simple as monitoring a port; this will help us track down any unauthorized
attempts at using VNC products...I just want to see what options I have.

Monitor the traffic/bandwidth of local computers ?

Hi everyone,
What is the software/script to monitor the traffic/bandwidth of the local users ?
I'm currently has Xserve as like a DHCP/gateway, and there are about 20 computers connects through Xserve. I'd like to monitor the local computers to see their bandwidth but not sure what script/software need to be installed on Xserve. All my local computers have ip 10.10.x.x.
I installed darkstat but it doesn't show me the specific ip address that taking how much bandwidth (like download/upload speed..).
Thanks

Take a look at Intermapper <http://dartware.com/>, Lithium <http://lithiumcorp.com/> and Zenoss <http://www.zenoss.com/>. They should be able to do what you want. Hope that helps.
- Barrett

Generate and Monitor Interconnect traffic

Guys
Does anyone has scripts to generate and monitor interconnect traffic? I am trying to test my interconnect on 4 node RAC (10gR2)
Any help?
Thanks in advance
PG

See if this helps....we use the below script to monitor the interconnect traffic.
select b1.inst_id,
b2.value "GCS CR BLOCKS RECEIVED",
b1.value "GCS CR BLOCK RECEIVE TIME",
((b1.value / b2.value) * 10) "AVG CR BLOCK RECEIVE TIME (ms)"
from gv$sysstat b1,
gv$sysstat b2
where b1.name = 'global cache cr block receive time' and
b2.name = 'global cache cr blocks received' and
b1.inst_id = b2.inst_id

Routing VLAN traffic

Is it possible to route VLAN traffic?
We have two buildings, each with several Catalyst 2950s and a 2651 router hosting several VLANS.
Can we connect the 2651s together and expand the VLANs into the other building?

HI
Can u give info about how these two buildings are connected to each-other.and as far routing in concerned u can configure sub-interfaces under u r physical inteface on u r router.Are this 2950's connected in 2651,if they how r u r vlans spread.r u using any sort of vtp.if u r 2950's are connected to 2651 then u can go for sub-interfaces per vlan.
for example if u r having 3 vlans then u can configure the the physical interface on u r router as
interface f0/0.1
encapsulation dot1q 1
ip address 192.168.1.1 255.255.255.0
and so on
Thanks
Mahmood

Monitor visitor traffic

Hi- Is the hit counter button the only way to monitor visitor traffic? Is there a way to see who is visiting my site? Thanks for your time.

I use stat counter, it IS safe and there ISN'T anything on a Mac so there is the need of 3rd party software. Another is Google Anayltics, but that's more complicated. You can use iTweak to easily apply your statcounter code, too

L4 traffic monitor - blocking traffic ?

Hello
How does L4 traffic monitor is blocking traffic if T1/T2 ports are "tap/sniffed ports" ?
For SPAN we might have "ingress vlan feature" which would allow us to send TCP RST (like IPS does),
but for hardware TAP we do not have such a feature.
So - maybe L4 traffic monitor can not block any traffic, just make a decision what to block and execution is on WebProxy and P1/2 ports ?
Thanks

Michael,
Yes, the reset is sent via P1
Ken
Sent from Cisco Technical Support iPad App

Monitoring VLAN traffic

Similar Messages

Maybe you are looking for