Real time int mon w/ Cisco 6509

I find that when I run the real time interface monitor on our 6509 switch, the local discription, time of last data rcvd/xmit and 5 min. avgs never populate. I have no problem with this tool on our 2900 switches. Is there just too much data?

-Ken

Find more posts tagged with

Accepted answers

All comments

Is the 6905 running CATOS while the 2900 is running IOS?

BK
Nobody Special

kleins

Yes. NG on the CATOS?

Yeah, The time of last data, and 5 minute averages are from the OLD-CISCO-INTERFACES-MIB MIB, which are not support by the CatOS software.

BK
Nobody Special

kleins

Thanks BK. What I'm ultimately looking for is a way to view top talkers on our network. Are you aware of any tool that would give me that info (not necessarily real time) for a small (< 300 nodes)network?
-Ken

DonYonce

kleins,
How about using Network Performance Monitor and monitoring the traffic through each switch port. That will give you top talkers in many different formats.

Network_Guru

Here's one way;

www.cisco.com/.../products_configuration_guide_chapter09186a00800d9e3f.html

You may be able to pull this info using netflow.

-=Cheers=-
NG

kleins

It may be sufficient to just get the top 10 or 25 interface stats off of the summary sheet, but it looks like I would need to modify the list of devices to only include the switch ports. Otherwise router up/down links take up the majority of the summary. Is there another way to do this or, more likely, am I missing something? I am running a demo, but so far it looks like it will be worth purchasing based on most of the tools, but I want to make sure I understand all that it can do for us. Thanks for the help!

-Ken

kleins

Thanks NG. For some reason I didn't see your reply until tonight. Show top reporting is definitely helpful, but I can sort of get that information from Solarwinds as well. I guess what I really want is netflow information, but I'm not getting complete data from the 6509 (show ip cache flow only shows data inbound to router VLAN and nothing on port to firewall except other MSFC) so I've been looking for another way to get IP/port info. I'll keep hunting, but thanks all!

-Ken

DonYonce

kleins,
You could use the "Summary Page", but I also think that may be too limiting for what you need.

Try this....
Open the SWNetPerfMon.cfg file with Microsoft Access. You can then query the NetPerfMon database directly and generate any kind of report you need.

The "Interfaces" table will give you the current statistics for each interface. You can easily limit it to a specifc group of interfaces, or join it to the Nodes table to select by a specfic group of Nodes. The InterfaceTraffic table gives you the traffic stats over time.

You can also add new columns to the Interfaces table and add information about who is attached to each port to include in your custom query.

kleins

Thanks Don. I'll give that a shot, but I think I'll need a way to determine who was connecting to what historically. The last company I worked for used Concord eHealth, which was great, but it would be overkill for the company I'm with now. They have peaked out their Internet connection and I need to verify what that traffic consists of. Pointing to top talkers may be sufficient, but I would need to be able to equate it to peak periods.
-Ken

Network_Guru

Netflow can do this if you are running a Hybrid Cat6509 or Native IOS with the most recent version of code. It will pickup ingress traffic on all your switch ports, along with source and destination IP and protocol.
Check out crannog-software.com if you have an extra $10k in your budget. This is a feature that would really take Orion to the next level! Not just a alert that a link is saturated, but by whom & what protocol. Now THAT's true network visibility in one nice package!

-=Cheers=-
NG

FormerMember

Check out ntop (http://www.ntop.org). This is an open source deal and I think it only runs on UNIX boxes but we use it a good bit where I work. We also use ARGUS for traffic profiling.