Network top talker! Bandwidth consumption!

Hello,
what is the best solution in cisco world for finding the top talkers in the network.
I need to know what bandwidth consumption per IP.
I found out that Cisco IOS router with solarwind using SNMP.
Does cisco ASA generate this kind of reports?
Regards,
Viorel

just use google and viola! https://supportforums.cisco.com/docs/DOC-6113 netflow stat in ASA.

Similar Messages

Bandwidth detection causes bandwidth consumption to spike

Hi everyone,
We are having a little problem implementing bandwidth detection with FMS, for some reason when enable it, bandwidth consumption spikes significantly I am wondering why? and if there a white paper somewhere that would talk about how properly implement this feature.
Kind regards.
+LA

Hi,
I dont think this should happen anyways can you tell exactly how did you concluded this. I mean to say how are you finding bandwidth usage as well as bandwidth detection.
The following link might be helpful for you.
http://livedocs.adobe.com/flashmediaserver/3.0/hpdocs/help.html?content=00000072.html#1068 463
Regards,
Amit

Bandwidth Consumption - How to Identify

I am having an issue reconciling what I am seeing on my box and what my ISP is reporting that I am using for bandwidth consumption.
For a sample hour, they report the following usage:
Usage: 0.240 GiB In / 0.374 GiB Out
Which if I am reading this correctly is 240MB in and 374 MB out.
However, when I use a utlility called vnstat I am getting:
112 MB In / 247 MB Out
Question: what other tools should I be trying to use to identify the discrepency. I thought I could be hacked, but I'm pretty sure I have not been compromised (not 100% though). I run very few services (ssh / http / smtp / pop3 / imap), run osiris on it nightly and various rootkit detection scripts.
The CPU utilization is about what I expect; I just don't understand the wide differences in the bandwidth consumption.
I realize this is a pretty broad question, even a pointer where I can learn more about how to analyze network issues would be appreciated.
Thanks,
Chris....

ok - I'm official outside my comfort zone. I took a tcp dump and analyzed in wireshark (the sniffer previously known as ethereal). I am seeing a lot of ARP packets that originzate from my ISP's routers.
Couple of questions for those who know more.
1. What is a lot of ARP traffic? I am seeing 220K packets & 15MB over a 10 minute span. I would think this is a bit excessive. Is it realated to the size of their network. At my last provider, I saw total inbound traffic during quite periods (late at night) of around 10MB per _hour_, so that is my limited comparision point.
2. Can I safely block this traffic in iptables? Some of it if it is not directed at my MAC address? Or should I just not worry about it and filter it out of my network reports when looking for problems.
Thanks,
Chris....

RMI bandwidth consumption

we're about to deploy a new third party RMI-based application.
The application is supposed to receive client connection through WAN .
running an initial bandwidth test to try to detect optimal bandwidth, we assumed worst-case-scenario where a 128kbps
leased line was used for client connections.
With only one client connecting, the bandwidth was fully used for 70% of the time and the client's download rate overcame its upload's.
since we have the sources and license to edit of the application, i looked up tis code a bit and i noticed that most of classes the client had loaded and was initiating the calls from existed only at the client side.
if those classes,existed in the server's classpath as well would that diminish the client's upload rate assuming that then the server would have whatever objects definitions the client is referencing through its calls ?
I might then alter the code in a way to redeploy the classes efficiently.
i don't know if i was clear enough, i could use some advice though.
thanks

ejp wrote:
The server only needs the classes that are reachable from the remote interface(s), and it most probably already has them. RMI doesn't send classes over the wire unless the java.rmi.server.codebase feature is enabled, and in any case it is a side-channel, usually via an HTTP server.i read the dynamic code downloading using RMI ref. document but one thing i still don't understand
"+if the remote method receives an object instance, for which the remote object cannot find the class definition locally in its CLASSPATH.he class of the object sent by the client will be a subtype of the declared parameter type. A subtype is either:+
+* An implementation of the interface that is declared as the method parameter (or return) type+
+* A subclass of the class that is declared as the method parameter (or return) type+
how can this case occur, and if it does the remote object will look for the class's definition at the codebase of the client , am i right?
The bandwidth utilization of an RMI invocation is a more or less linear function of the size of the arguments and return value, including all non-static non-transient objects reachable from them.if i understand you well , to minimize the consumption, the objects that are to be used as arguments you are talking about should be coded in a way that uses transient and static wherever applicable and possible,and the smaller objects you provide the less bandwidth you use.
am i right ?
Other than that is there any way or any measures that can help in this direction?
regards

HOW TO CONFIGURE GUEST NETWORK AND LIMITE BANDWIDTH

Dear all,
Please help me how to configure internet access rule and limited the bandwidth for guest network via TMG Forefront 2010.
Thanks you & best regards,
Hung Viet

Hi，
First you can create the new network set which is mapped to guest subnet, after that you can create access rule for this network set.
If you want to control bandwidth, you may need 3-party tool like this:http://www.bsplitter.com/
Best Regards
Quan Gu

Bandwidth Consumption through RV180

Hi,
I am working with a customer utilizing a RV180 as their EDGE device and an SF102 small business 24 port switch for switching. At times, we are experiencing issues whereby some device or devices are consuming all available WAN bandwidth, causing the internet to be poor-performing at best during this timeframe. We are looking for a way to determine what specific host or hosts are consuming all of this bandwidth. I know with an ASA you can set up Netflow through PRTG - can this be done on the RV180 and if so, how can I set this up? Or is there some other methodology I can use to find the culprit host(s)?
Thanks,
Mike

ok - I'm official outside my comfort zone. I took a tcp dump and analyzed in wireshark (the sniffer previously known as ethereal). I am seeing a lot of ARP packets that originzate from my ISP's routers.
Couple of questions for those who know more.
1. What is a lot of ARP traffic? I am seeing 220K packets & 15MB over a 10 minute span. I would think this is a bit excessive. Is it realated to the size of their network. At my last provider, I saw total inbound traffic during quite periods (late at night) of around 10MB per _hour_, so that is my limited comparision point.
2. Can I safely block this traffic in iptables? Some of it if it is not directed at my MAC address? Or should I just not worry about it and filter it out of my network reports when looking for problems.
Thanks,
Chris....

I'm unable to join wifi network with talk talk

I can join another network but not my home one keeps coming up unable to join network. I have updated soft wear but no good

What security settings are configured on the talk talk WiFi network?
Did you enter the correct WiFi username and password when connecting to the WiFi network?

SAP Community Network Top Contributor 2008

Hi,
I got a mail from anotherworld-km.com stating :"In appreciation of your active contribution, we will be sending you a Community Badge to mark your achievement in becoming an SAP Community Network 2008 Top Contributor." They also asked for shipment address so that they can send the same in a mnth. Did ne 1 got this mail. Wat is it all about?? Do we really get a badge for contribution or is it jst a promotional mail???
Regards
Priyanka

>
Craig Cmehil wrote:
> If you search the site for "Another World" you'll find multiple threads asking the very same question, the basic answer is "yes" it's real, but you are welcome to decline it.
Craig:
Who is going to decline the "Community Badge" when they are going to receive it from SDN.
Everyone receives it like an honor from SDN; however its a good option to decline so that the money spend in courier can also be utilized for "Food for Points" initiative:)
Regards,
Subhash

Youtube App is still a joke - why is there no button to switch to High-Quality on a 3G network with high bandwidth?

I was hoping that with iOS5 Apple is also updating the remaining Youtube App - but NO - the problem: Videos are shown in extremely bad resolution when you are logged in a 3G Network - when you are logged in via wifi then the quality of the same video is superb. The workaround: You have to go to the mobile version of youtube and watch the videos via Browser - there is a button to change to High-Quality manually - this button is missing in the Apple-Youtube-App - why is it this difficult for Apple to integrate this function - we have one of the best 3G networks here in Austria, usually there is a download-speed of approximately 2 - 5 Mbit - there is no need to reduce the bit rate when watching youtube mobile on iPad or iPhone on a 3G network. In early days the quality of youtube videos was very bad so it was not a real problem, nowadays when we "could" watch nearly HD on iPad when being on a presentation this IS a problem. Please Apple, these are so simple wishes ...

These are user-to-user forums, they are not monitored by Apple (there are too many forums/threads/messages for that to happen). If you want to leave feedback for Apple then you can do so here : http://www.apple.com/feedback/ipad.html

1250AP's with 4400 Controllers - LWAPP WAN Bandwidth consumption

Does anyone know and, preferably, have a link on how much bandwidth a Lightweight AP consumes when deployed across a WAN link? I know Cisco keeps saying no more then 8 across a WAN managed by a centralized controller, but I can't find anything specific. Thanks so much in advance.

There's a lot of components in LWAPP packets which will vary according to different situation.check this for LWAPP detail: http://tools.ietf.org/html/draft-ohara-capwap-lwapp-02
actually, A discovery request packet is 97 bytes (including the 4 byte FCS),A discovery response packet is 106 bytes (including the 4 byte FCS), Packet sizes for the join request and response messages will vary based on the MTU supported by the transport(1596 or 1596+1500),The initial exchange between the AP and the WLC (ap-manager interface) is approximately 6,000 bytes and a one-time configuration change averages 360 bytes and involves 2 packets each from the AP and the
WLC's ap-manager interface.An RRM-related information exchange takes place once the AP has been provisioned. A typical exchange
between the AP and the WLC (ap-manager interface) is approximately 1400 bytes. In the event of an RRM-related configuration change, there is a four-packet exchange between the AP and the WLC's apmanager
interface. This exchange averages 375 bytes.The system heartbeat, coupled with fallback mechanism, is 4 packets every 30
seconds and comprises of the following packets:
LWAPP ECHO_REQUEST from AP (78 bytes)
LWAPP Echo-Response to AP (64 bytes)
LWAPP PRIMARY_DISCOVERY_REQ from AP (93 bytes)
LWAPP Primary Discovery-Response to AP (97 bytes).
There are two ongoing RRM exchanges. The first one, at every 60-second interval is the load and signal
measurement and consists of 4 packets. This exchange always adds up to 396 bytes, as following:
LWAPP RRM_DATA_REQ from AP (107 bytes)
LWAPP Airewave-Director-Data Response to AP (64 bytes)
LWAPP RRM_DATA_REQ from AP (161 bytes)
LWAPP Airewave-Director-Data Response to AP (64 bytes)
The second sequence of packets is the noise measurement (including a statistics information request and
response sequence) done every 180 seconds. This is a short (0.01 seconds typically) exchange of packets
and averages 2,660 bytes approximately. It consists of the following packets:
LWAPP RRM_DATA_REQ from AP
LWAPP Airewave-Director-Data Response to AP
LWAPP RRM_DATA_REQ from AP
LWAPP Airewave-Director-Data Response to AP
LWAPP RRM_DATA_REQ from AP
LWAPP Airewave-Director-Data Response to AP
LWAPP RRM_DATA_REQ from AP
LWAPP Airewave-Director-Data Response to AP
LWAPP STATISTICS_INFO from AP
LWAPP Statistics-Info Response to AP
LWAPP RRM_DATA_REQ from AP
LWAPP Airewave-Director-Data Response to AP
LWAPP RRM_DATA_REQ from AP
LWAPP Airewave-Director-Data Response to AP
LWAPP RRM_DATA_REQ from AP 00:14:1b:59:41:80
LWAPP Airewave-Director-Data Response to AP
LWAPP RRM_DATA_REQ from AP
LWAPP Airewave-Director-Data Response to AP
LWAPP STATISTICS_INFO from AP
LWAPP Statistics-Info Response to AP.
Rogue measurements are done as a part of the scanning mechanism (for more details, refer to the Auto RF
and Rogue Detection whitepapers) and included in the above RRM exchange every 180 seconds.
The LWAPP data frame header adds 6 bytes to the existing 802.11 packets.
Since LWAPP frames can be fragmented, a Fragment ID field is included and the total packet size can be
determined by adding the original frame and the IP Fragment that follows (It is important to note that the IP
Fragment that follows is not encapsulated in any LWAPP headers).
In conclusion, operation of LWAPP does not introduce heavy bandwidth requirements on the infrastructure and in most typical deployments, there would be no such need to add extra capacity to the infrastructure to accommodate Cisco's Unified Wireless Architecture.

N and G networks not "talking" to each other

Hi Everyone,
I have an Airport Extreme (802.11n) which is connected to our cable modem. Following an article in Macworld, I set up two networks, one for our "N" machines (a new iMac and a Macbook) and a "G" network for our older laptops (a PBG4 and a G4 iBook). The "G" network begins with an AEX which is connected to the Extreme via an ethernet cable. The "N" network is 5ghz and all works well except for one thing. I recently converted the "G" network to WDS; both the AEX base station and the WDS AEX relay have speakers attached to them, and the remote AEX (the last in the chain) is connected to our printer. Before I changed the AEXs to WDS, the "N" machines could both print and play to the connected speakers in the "G" network, but since I switched the "G" network to WDS, the "N" machines can't do so. (The AEXs don't show up in Airport Utility or iTunes on the "N" machines.) The only way we can print or play music from the "N" machines is to switch to the "G" network. I must have missed something when I set up the "G" WDS network. I'd like to make it so the "N" machines can stay on the "N" network but can access the functions on the "G" network. Thanks in advance.
Joe

In this network configuration, the key is to make sure that the AirPort Express Base Station (AX), that is acting as the main base station in the WDS, is configured as a bridge. (Connection Sharing = Off (Bridge Mode))

Spotlight & Network Account & Low Bandwidth

When i log in on my MacBook at home I do this via Network Login over an ADSL Line (down 6Mbit/sec, up 0,5Mbit/sec)
Now the problem comes in. Spotlight sees my network Home Folder as Volume and so creates a .Spotlight-V100 folder.
Searching perfomes somewhat slow but it works also over the internet.
Then from time to time Spotlight seems to rebuild the index on the Networked Home folder. As it is about 20 Megabytes it will bedcom nearly impossibe to continue work while spotlight rebuilds the metadata.mds file in the .Spotlight-V100 folder. It ***** up my complete upstream of 0,5 Mbit / sec until the 20 Megabytes are transferred.
When i go into Terminal and look into the folder i will finde contents like this:
-rw------- 1 dt staff 8 Dec 7 10:21 master-change-id
-rw------- 1 dt staff 280 Dec 6 18:42 master-change-list-00000001
-rw------- 1 dt staff 98694 Dec 6 23:05 master-change-list-00000002
-rw------- 1 dt staff 12265 Dec 7 00:14 master-change-list-00000003
-rw------- 1 dt staff 35997 Dec 7 00:58 master-change-list-00000004
-rw------- 1 dt staff 1986 Dec 7 01:48 master-change-list-00000005
-rw------- 1 dt staff 1854 Dec 7 02:33 master-change-list-00000006
-rw------- 1 dt staff 4417 Dec 7 03:21 master-change-list-00000007
-rw------- 1 dt staff 1449 Dec 7 04:09 master-change-list-00000008
-rw------- 1 dt staff 2906 Dec 7 04:54 master-change-list-00000009
-rw------- 1 dt staff 2275 Dec 7 05:44 master-change-list-0000000a
-rw------- 1 dt staff 5061 Dec 7 07:18 master-change-list-0000000b
-rw------- 1 dt staff 1561 Dec 7 08:05 master-change-list-0000000c
-rw------- 1 dt staff 384 Dec 7 08:51 master-change-list-0000000d
-rw------- 1 dt staff 3692 Dec 7 09:38 master-change-list-0000000e
-rw------- 1 dt staff 8743 Dec 7 10:21 master-change-list-0000000f
-rw------- 1 dt staff 11143 Dec 7 11:07 master-change-list-00000010
drwx------ 3 dt staff 102 Dec 7 11:06 mds-lock-dir
-rw------- 1 dt staff 22764390 Dec 7 10:21 metadata.mds
drwx------ 2 dt staff 68 Dec 4 11:58 slave-work-dir
The strange thing ist that sometimes the metatata.mds file isnt touched or changed for hours. But then whenn changing, reindexing or whatever happens there begins it does it about every 50 Minutes. So every 50 Minutes my upstrem gets high loades for ten minutes.
That is very arguable. I use this breaks then to get another cup of coffe or something else.
I just don't know why this rebuilding somtimes does not happen at all, and then suddenly for about every 50 Minutes.
Looks like a bug to me.
Would be lucky if someone has good advice. Thanks
regards
Dirk

The screen not drawing issue is because the user's /Library/Caches/com.apple.ATS/$UID/fonts.db file has corrupted. As another user, delete it and they can log in. I wrote a startupitem that deletes all of them and haven't had to go out for that problem since.
The second problem, if you have less than 100 users, although it's kludgy, maybe it would be easier to just remake the users, with the same numerical UID, when they're out.
Roger

Hiding top talking ports in reports

I may be on the wrong route here, but I am setting up mars for the first time. Now that I have a couple of devices sending logs and netflow, how do I hide the hight traffic ports in reports that I know is regular traffic. Like in the system report, Destination Ports ranked by Sessions, port 1720 is all the voice traffic, which is 10x more than any other traffic on the network. Is there a way to hide that from the reports so that I can easily see irregular traffic? Or will that go away after MARS "baselines"?

Hello Ben
If you make a drop rule for traffic coming to this port then it will stop showing in the report (but this will not really hide it). Like we have a FWSM sending level 7 syslogs to the MARS. We says a lot of 'sessions' were related to SNMP, Proxy 8080. So we just made a drop rule for both and this greatly reduced the load on our MARS, reducing I think about 2 million events per day.
Also just to 'hide', you can most probably edit the Query, click on destination port and add "NOT EQUAL" Port 1720. You can also filter by source IP/Destination (for example exclude traffic directed/sourced from the IPT server).
Regards
Farrukh

Strange network bandwidth management

Hi,
I've noticed some strange behaviour of Remote Desktop Services.
I have remote Windows Server 2012 R2 running in data center. There is 100 Mb/s download / 100 Mb/s upload internet link tested with speedtest.net. I have also two laptops with Windows 8.1 in my office running on 25 Mb/s donwload / 3 Mb/s upload link. One
of the laptops has 1280 x 800 screen resolution and the second one has 2880 x 1620 pixels.
I tested the connection speed by downloading 2 GB file from Windows Server to my laptop. File was downloaded with 25 Mb/s speed as expected. So the connection is perfectly OK.
I've configured our application as RemoteApp on Windows Server and have been testing this environment on my laptops. Some modules of our application are "rendering intensive" - they change some big portion of screen 10 times per second. And
here the problem starts.
When I test RemoteApp only on my low resolution laptop all work great. RDP protocol utilizes about 1 Mb/s of bandwidth.
When I test application on my high resolution laptop RDP protocol utilizes about 5 Mb/s of bandwidth and application presents very low frame rate (1 frame per second maybe). I don't know why this happens. I have 20 Mb/s link and only 5 Mb/s is being used
by RDP.
And magic happens...
When I start my RemoteApp on both laptops frame rate is perfect on both of them! Windows Server is uploading 14 Mb/s (1 Mb/s to low resolution laptop and 13 Mb/s to high resolution one). It streams 6 Mb/s more to high resolution laptop than in "single
laptop" scenario! When I close or even minimize (!) application on low resolution laptop the frame rate on second laptop degrades. When the application is resumed, frame rate goes up.
The same behaviour is observed when I run RemoteApp on high resolution laptop only but I connect through RDP to my Windows Server and turn on session shadowing. I observe my laptop's session through shadowing and frame rate magically goes up.
It's strange that streaming RDP sessions to two laptops produces better experience than doing it only for one client. I'm able to reproduce this behaviour every day, every time in two locations with different internet service providers.
I turned off all magic fair sharing (disk, CPU, network) on Windows Server but without any success. The same about turning off UDP connections or connecting with and without RD Gateway. I think that there is some magic algorithm for resources management
that is causing it. I've been searching internet and testing different scenarios for week but without any luck.
Have anybody seen something like this? I would be very grateful for your help.
Wojtek Małota

Hi Wojciech,
Bandwidth consumption when using RemoteApp programs could increase and decrease, depending on the application and its usage, when compared to using a remote desktop. There are lot of factors which can be taken into considerations when measuring performance
for RemoteApp\Desktop. You can go through below article for detail as also there is RDP performance whitepaper to understand clearly.
RDS: Choosing between Delivering RemoteApps versus Full Desktops
http://social.technet.microsoft.com/wiki/contents/articles/1366.rds-choosing-between-delivering-remoteapps-versus-full-desktops.aspx
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Report for Material Consumption for WBSE & Network

Dear Experts,
I want to see Material Consumption for
for WBSE 281Q (Project to Project)
for Network 221Q (Network from Project)
I can see values in Report MB51,
but I can not see for which WBSE it is consumed or from which WBSE it is consumed.
The Entries are there in table MSEG field MAT_PSPNR.
It is not shown in Report MB51, For this column blank is shown, no value is shown.
Can you help me, how can I see material consumption for WBSE & Network with WBSE ID for/from which.
Thanks
SSanjay

Dear Muralee,
I think I am not able to explain you the thing or you are not getting what I want to say.
In my first post I have said:
I am trying MB51, with
221Q Project to Project GI
281Q Project to Network GI.
I am getting material consumption quantities,
Network/Activities for which consumption is done is also shown.
But the WBSE for which / from which consumption is done, that column is blank.
It is showing WBSE for 101 GR for Project
I want to know for which /from which WBSE material was consumed?
I have tried to explain problem again.
Can you please help?
SSanjay

Network top talker! Bandwidth consumption!

Similar Messages

Maybe you are looking for