how to monitor bandwith/traffic in a cisco router

Discussion in 'Cisco' started by jcharth, Feb 24, 2005.

  1. jcharth

    jcharth Guest


    Can anyone tell me if there is a command to monitor traffic by ips or
    bandwith in a cisco router?
    jcharth, Feb 24, 2005
    1. Advertisements

  2. jcharth

    haddub Guest

    Show interface will give you the five minute average bandwidth
    utilization. You can adjust the period it averages to fit your needs.
    haddub, Feb 24, 2005
    1. Advertisements

  3. jcharth

    Merv Guest

    load-interval is the command to change the time period the default is 5

    to change it to 30 seconds, config

    load-interval 30

    on each interface
    Merv, Feb 24, 2005
  4. Phillip Remaker, Feb 24, 2005
  5. jcharth

    anybody43 Guest

    "Show interface will give you the five minute average bandwidth
    load-interval is the command to change the time period the default is 5

    minutes "


    Just a reminder, the 5 minute (or whatever) number is NOT an
    average in the usual sense.

    It is a weighted average that puts more importance on recent values
    and less importance on older values. If an interface is offered first
    zero load and then suddenly 100% load, the "load" displayed by the
    show interface command can be seen to change for over 15 minutes.

    The value of the weight applied for a particular age is computed from
    an exponential function. It is in the docs. Anyone interested might
    look up "exponential weighted average". The "5 minutes" is merely
    a parameter of the function.
    anybody43, Feb 24, 2005
  6. jcharth

    jcharth Guest

    thanks for the reply,

    is it possible to add a centing to the internet router of my provider
    to allocate certain bandwith to my mail server? is MCI t1 performance
    any good?
    jcharth, Feb 26, 2005
  7. jcharth

    support Guest

    So far I was unable to find the reference on the Cisco website, but
    face the problem of needing to compare, and validate, the results of
    different methods for IP accounting: NetFlow, "ip accounting output
    packets", and what data is collected by MRTG (I didn't decypher this in
    detail, but it looks like it has some input and output bytes that could
    be cut out from the mrtg log file with 'cut', 'head' and 'tail', if
    used appropriately).

    For some reason, these methods yield very different results, and it's
    hard to know which is which - the Cisco web site doesn't readily offer
    the gory details. If you have any pointers to a FM to share, or other
    insight that might put me on the right track, that would be great!

    support, Apr 5, 2005
  8. jcharth

    anybody43 Guest


    I have had a look for the exponetnial weighted
    average material and it is indeed gone.

    There it this:-

    5 minute input rate, 5 minute output rate

    "Average number of bits and packets transmitted per second
    in the last 5 minutes. If the interface is not in promiscuous mode,
    it senses network traffic that it sends and receives (rather than
    all network traffic).

    The 5-minute input and output rates should be used only as an
    approximation of traffic per second during a given 5-minute period.
    These rates are exponentially weighted averages with a time
    constant of 5 minutes. A period of four time constants must pass
    before the average will be within 2 percent of the instantaneous
    rate of a uniform stream of traffic over that period.

    Note The 5-minute period referenced in this output is a load interval
    that is configurable under the interface. The default value is 5

    On a typical Ethernet network many packets enter the router
    that are not forwarded. Over long periods (days) they can be a
    huge proportion of the traffic. These will mostly be broadcasts
    but there may be a number of flooded unicasts too. These packets
    appear on interface input counters but not on netflow counters.

    You need to think carefully about exactly what the numbers
    you are looking at represent.
    anybody43, Apr 5, 2005
  9. jcharth


    Oct 29, 2009
    Likes Received:
    The best technology to monitor bandwidth based on IPs from a Cisco router is NetFlow. The advantage is its capability for in depth reports (by IP's and applications) and that it is available in most of the Cisco IOS by default removing the need for additional investment.

    All you will need is a collector software which can collect the NetFlow packets from the devices and generate the reports. For a free tool, try Manageengine Netflow Analyzer. This free tool is more complete with no deletion of historic data but limited to monitoring 2 interfaces.

    donthomas, Oct 29, 2009
  10. jcharth


    Jun 19, 2009
    Likes Received:
    Cisco device provides traffic status in minimum 30 seconds interval. Netflow is good idea, but free Netflow tool won't give you real-time monitoring. If you want to monitor your WAN link in real-time, try this.
    I am working ISP field over 10 years and I always introduce this tool for all my clients while troubleshooting. It is called STG using SNMP. Of course IT is FREE and very tiny.
    Check below link and try.

    You can monitor any other network devices with this tool as long as device support SNMP.
    I hope this is informative for everybody.
    Last edited: Apr 17, 2010
    theapplebee, Oct 30, 2009
  11. jcharth


    Nov 17, 2009
    Likes Received:
    what about bandwidth monitor you can try use ProteMac Meter.It;s really nice prog)
    Williams, Sep 10, 2010
  12. jcharth


    Apr 11, 2012
    Likes Received:


    curl -s --header 'Authorization: Basic YOURAUTHSTRINGHERE==' -i ''


    perl -e '$cmd=q(curl -s --header "Authorization: Basic YOURAUTHSTRINGHERE==" -i ""); while(1){ $rc=`$cmd`;($s,$r)=($rc=~/(\d+) bytes sent, (\d+) received/); print $s-$os . "\t"; print $r-$or . "\t"; print "\t($s,$r)\n"; $os=$s; $or=$r; sleep(60)}'

    Unrelated, but handy:-
    A commandline one-liner to set the correct date into cisco 8xxx a router:-

    curl -s --header 'Authorization: Basic YOURAUTHSTRINGHERE==' -i `date +''`

    Do a tcpdump when connecting to your router via a browser if you want to grab your auth string easily.
    cndg, Apr 11, 2012
  13. jcharth


    Apr 11, 2012
    Likes Received:
    FYI - this is what the above command line returns:-

    HTTP/1.1 200 OK
    Date: Wed, 11 Apr 2012 13:19:25 GMT
    Server: cisco-IOS
    Connection: close
    Transfer-Encoding: chunked
    Content-Type: text/html
    Expires: Wed, 11 Apr 2012 13:19:25 GMT
    Last-Modified: Wed, 11 Apr 2012 13:19:25 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Accept-Ranges: none

    <HTML><HEAD><TITLE>yourroutername /exec/-/show/pppoe/session/all</TITLE></HEAD>
    <A HREF=/level/15>Home</A> <A HREF=/level/15/exec/->Exec</A> <A HREF=/level/15/exec/-/configure/http>Configure</A>
    <FORM METHOD=POST ACTION="/exec/-/show/pppoe/session/all">
    <INPUT TYPE=HIDDEN NAME=command_url VALUE="/exec/-">
    <H4>Output</H4><H5>Command base-URL was: /exec/-
    Complete URL was: /exec/-/show/pppoe/session/all
    Command was: show pppoe session all </H5><PRE><HR><DL>
    Total PPPoE sessions 1

    PPPoE Session Information

    session id: 7029
    local MAC address: 0004.27fd.7e71, remote MAC address: 0090.2345.42d5
    virtual access interface: Vi1, outgoing interface: ATM0.1, vc: 8/35
    21420879 packets sent, 31596727 received
    2797673456 bytes sent, 905861695 received</DL><HR><PRE>command completed.
    cndg, Apr 11, 2012
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.