Charlie_Boy

My main internet router is getting hammered by our users, other than the show IP accounting cmd, and tracing the IP's through the firewall, is there anything else that i can do on the router to check traffic.

P1Fanatic

Yeah Id like to know this. IP accouting is good but it only tells u source IP, dest IP, packets and bytes.

Cougar

We has this at work and the cause of it was some muppet had set the Laser Printer gateway to be the main router IP Addy check this using the IP Accounting and also try a piece of software called (I think IP Track) which we use I will post it's details 2morrow for u.

SiCotty

On most routers from 1600 upwards netflow is now supported. This will give you more detailed information than using IP accounting. The information the router shows is limited but if you use an external netflow collector (demo version from the Cisco site) such as the Cisco one (expensive) or cflowd on linux (free) then you can see much more info on each flow. This is source dest ip, source dest port and size and duration of flow.

If you do switch it on (ip route-cache flow under the interface) please do this late in the day just in case the router decides to do something anti social.

http://www.cisco.com/univercd/cc/td/...rt2/xcfnfc.htm

Si

P1Fanatic

SiCotty nice one - will take a look at that next time Im in work.

BTW do what I always do - "reload in 5" incase the router goes pete tong!