You can turn up a NetFlow server which is at times complex or time consuming. A quick/dirty way to find out who is causing your issue may be just to enable "ip route-cache flow" on a L3 interface that his traffic is flowing through, then doing "show ip cache flow" - if he's sending out a ton of packets you may be able to catch it w/ this versus going the NetFlow route (NetFlow is much much better but unless you have a ton of unix/linux background getting the netflow collector/analyzer active may be a complex chore in itself..)
FYI I saw that SolarWinds just put out a free/30 day demo NetFlow collector/analyzer in the past few months you can try that for a quick Win32 NetFlow software solution to isolate this quick... http://www.solarwinds.com/products/orion/nta/ Best of luck! -Rich On Thu, Mar 26, 2009 at 8:15 AM, Wilkinson, Alex < [email protected]> wrote: > Hi all, > > I would like to put in place measures to be able to pin point the > particular > user(s) who are thrashing out our WAN connection. I am thinking ... > > Mirror all ports (SPAN) to a spare port and use trafshow to pinpoint the > culprit. > > However, i am curious how others deal with this situation ? > > -aW > > IMPORTANT: This email remains the property of the Australian Defence > Organisation and is subject to the jurisdiction of section 70 of the CRIMES > ACT 1914. If you have received this email in error, you are requested to > contact the sender and delete the email. > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
