how to monitor bandwith/traffic in a cisco router

Discussion in 'Cisco' started by jcharth@hotmail.com, Feb 24, 2005.

  1. Guest

    Hello,

    Can anyone tell me if there is a command to monitor traffic by ips or
    bandwith in a cisco router?
    thanks
    , Feb 24, 2005
    #1
    1. Advertising

  2. haddub Guest

    Show interface will give you the five minute average bandwidth
    utilization. You can adjust the period it averages to fit your needs.
    haddub, Feb 24, 2005
    #2
    1. Advertising

  3. Merv Guest

    load-interval is the command to change the time period the default is 5
    minutes

    to change it to 30 seconds, config

    load-interval 30

    on each interface
    Merv, Feb 24, 2005
    #3
  4. Phillip Remaker, Feb 24, 2005
    #4
  5. Guest

    "Show interface will give you the five minute average bandwidth
    utilization.
    load-interval is the command to change the time period the default is 5

    minutes "

    Hi,

    Just a reminder, the 5 minute (or whatever) number is NOT an
    average in the usual sense.

    It is a weighted average that puts more importance on recent values
    and less importance on older values. If an interface is offered first
    zero load and then suddenly 100% load, the "load" displayed by the
    show interface command can be seen to change for over 15 minutes.

    The value of the weight applied for a particular age is computed from
    an exponential function. It is in the docs. Anyone interested might
    look up "exponential weighted average". The "5 minutes" is merely
    a parameter of the function.
    , Feb 24, 2005
    #5
  6. Guest

    thanks for the reply,

    is it possible to add a centing to the internet router of my provider
    to allocate certain bandwith to my mail server? is MCI t1 performance
    any good?
    , Feb 26, 2005
    #6
  7. Guest

    Hi,

    you wrote:
    > Just a reminder, the 5 minute (or whatever) number is NOT an
    > average in the usual sense.
    >
    > ...
    >
    > The value of the weight applied for a particular age is computed from
    > an exponential function. It is in the docs. Anyone interested might
    > look up "exponential weighted average". The "5 minutes" is merely
    > a parameter of the function.


    So far I was unable to find the reference on the Cisco website, but
    face the problem of needing to compare, and validate, the results of
    different methods for IP accounting: NetFlow, "ip accounting output
    packets", and what data is collected by MRTG (I didn't decypher this in
    detail, but it looks like it has some input and output bytes that could
    be cut out from the mrtg log file with 'cut', 'head' and 'tail', if
    used appropriately).

    For some reason, these methods yield very different results, and it's
    hard to know which is which - the Cisco web site doesn't readily offer
    the gory details. If you have any pointers to a FM to share, or other
    insight that might put me on the right track, that would be great!


    Thanks,
    --Toni++
    , Apr 5, 2005
    #7
  8. Guest

    Hello,

    I have had a look for the exponetnial weighted
    average material and it is indeed gone.

    There it this:-

    http://www.cisco.com/en/US/products...ommand_reference_chapter09186a008010f97d.html
    Says:-

    5 minute input rate, 5 minute output rate

    "Average number of bits and packets transmitted per second
    in the last 5 minutes. If the interface is not in promiscuous mode,
    it senses network traffic that it sends and receives (rather than
    all network traffic).

    The 5-minute input and output rates should be used only as an
    approximation of traffic per second during a given 5-minute period.
    These rates are exponentially weighted averages with a time
    constant of 5 minutes. A period of four time constants must pass
    before the average will be within 2 percent of the instantaneous
    rate of a uniform stream of traffic over that period.

    Note The 5-minute period referenced in this output is a load interval
    that is configurable under the interface. The default value is 5
    minutes."

    On a typical Ethernet network many packets enter the router
    that are not forwarded. Over long periods (days) they can be a
    huge proportion of the traffic. These will mostly be broadcasts
    but there may be a number of flooded unicasts too. These packets
    appear on interface input counters but not on netflow counters.

    You need to think carefully about exactly what the numbers
    you are looking at represent.
    , Apr 5, 2005
    #8
  9. donthomas

    Joined:
    Oct 29, 2009
    Messages:
    4
    The best technology to monitor bandwidth based on IPs from a Cisco router is NetFlow. The advantage is its capability for in depth reports (by IP's and applications) and that it is available in most of the Cisco IOS by default removing the need for additional investment.

    All you will need is a collector software which can collect the NetFlow packets from the devices and generate the reports. For a free tool, try Manageengine Netflow Analyzer. This free tool is more complete with no deletion of historic data but limited to monitoring 2 interfaces.

    Regards,
    Thomas
    donthomas, Oct 29, 2009
    #9
  10. theapplebee

    Joined:
    Jun 19, 2009
    Messages:
    67
    Location:
    USA
    Cisco device provides traffic status in minimum 30 seconds interval. Netflow is good idea, but free Netflow tool won't give you real-time monitoring. If you want to monitor your WAN link in real-time, try this.
    I am working ISP field over 10 years and I always introduce this tool for all my clients while troubleshooting. It is called STG using SNMP. Of course IT is FREE and very tiny.
    Check below link and try.

    http://www.ipBalance.com/traffic-an...me-bandwidth-monitoring-by-snmp-tool-stg.html

    You can monitor any other network devices with this tool as long as device support SNMP.
    I hope this is informative for everybody.
    Last edited: Apr 17, 2010
    theapplebee, Oct 30, 2009
    #10
  11. Williams

    Joined:
    Nov 17, 2009
    Messages:
    25
    what about bandwidth monitor you can try use protemac.com ProteMac Meter.It;s really nice prog)
    Williams, Sep 10, 2010
    #11
  12. cndg

    Joined:
    Apr 11, 2012
    Messages:
    2
    commandline;

    Once:-

    curl -s --header 'Authorization: Basic YOURAUTHSTRINGHERE==' -i 'http://192.168.0.1/level/15/exec/-/show/pppoe/session/all'

    Continuous:-

    perl -e '$cmd=q(curl -s --header "Authorization: Basic YOURAUTHSTRINGHERE==" -i "http://192.168.0.1/level/15/exec/-/show/pppoe/session/all"); while(1){ $rc=`$cmd`;($s,$r)=($rc=~/(\d+) bytes sent, (\d+) received/); print $s-$os . "\t"; print $r-$or . "\t"; print "\t($s,$r)\n"; $os=$s; $or=$r; sleep(60)}'

    Unrelated, but handy:-
    A commandline one-liner to set the correct date into cisco 8xxx a router:-

    curl -s --header 'Authorization: Basic YOURAUTHSTRINGHERE==' -i `date +'http://192.162.0.1/level/15/exec/-/clock/set/%H:%M:%S/%b/%d/%Y'`

    Do a tcpdump when connecting to your router via a browser if you want to grab your auth string easily.
    cndg, Apr 11, 2012
    #12
  13. cndg

    Joined:
    Apr 11, 2012
    Messages:
    2
    FYI - this is what the above command line returns:-

    HTTP/1.1 200 OK
    Date: Wed, 11 Apr 2012 13:19:25 GMT
    Server: cisco-IOS
    Connection: close
    Transfer-Encoding: chunked
    Content-Type: text/html
    Expires: Wed, 11 Apr 2012 13:19:25 GMT
    Last-Modified: Wed, 11 Apr 2012 13:19:25 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Accept-Ranges: none


    <HTML><HEAD><TITLE>yourroutername /exec/-/show/pppoe/session/all</TITLE></HEAD>
    <BODY><H1>yourroutername</H1><PRE>
    <A HREF=/level/15>Home</A> <A HREF=/level/15/exec/->Exec</A> <A HREF=/level/15/exec/-/configure/http>Configure</A>
    <HR>
    <FORM METHOD=POST ACTION="/exec/-/show/pppoe/session/all">
    <DT><INPUT TYPE=SUBMIT VALUE=Command><INPUT TYPE=TEXT NAME=command SIZE=60 VALUE="">
    <INPUT TYPE=HIDDEN NAME=command_url VALUE="/exec/-">
    <H4>Output</H4><H5>Command base-URL was: /exec/-
    Complete URL was: /exec/-/show/pppoe/session/all
    Command was: show pppoe session all </H5><PRE><HR><DL>
    Total PPPoE sessions 1

    PPPoE Session Information

    session id: 7029
    local MAC address: 0004.27fd.7e71, remote MAC address: 0090.2345.42d5
    virtual access interface: Vi1, outgoing interface: ATM0.1, vc: 8/35
    21420879 packets sent, 31596727 received
    2797673456 bytes sent, 905861695 received</DL><HR><PRE>command completed.
    </FORM><HR>
    </PRE></BODY></HTML>
    cndg, Apr 11, 2012
    #13
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Eric

    cisco 2950 limit bandwith

    Eric, May 10, 2006, in forum: Cisco
    Replies:
    1
    Views:
    891
  2. Evolution
    Replies:
    1
    Views:
    856
    Walter Roberson
    Feb 27, 2007
  3. Molecule

    router with bandwith capabilities?

    Molecule, Nov 16, 2007, in forum: Computer Support
    Replies:
    3
    Views:
    757
    Stace
    Nov 17, 2007
  4. ng_reader
    Replies:
    8
    Views:
    932
    §ñühw¤£f
    Aug 16, 2009
  5. tg
    Replies:
    3
    Views:
    1,338
Loading...

Share This Page