If you don't see a similar but opposite spike on another system, then I would look to see if it was caused by a counter reset. If it is real traffic then it needs to ether go somewhere or come from somewhere. If you get a spike on only one interface of a switch, then there is an issue.
* It could be mis-reporting the spike. * The switch could be dropping the traffic. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Eric Brander Sent: Tuesday, October 26, 2004 5:15 AM To: [EMAIL PROTECTED] Subject: [mrtg] Re: A Philosophical / Procedural Question Tim Holmes wrote: > Good Morning Folks: > > I have been using MRTG to monitor my switches for about 2 weeks now, > and I have what I guess you would call more of procedural or > philosophical question (yeah, I know its early in the morning for > that!) :) > > Occasionally, I am seeing a port or ports on one of the switches (it > varies) that are showing a huge spike in traffic. In some cases its > outbound, in others its inbound. For example I came in and checked > stuff this morning, and found one of the ports has been averaging 590 > b/s all night (inbound) and 595 b/s Outbound with peaks over 700 b/s > > I walked the wire backwards, and found that this port is connected to my Ghost server, and it has been doing nothing all night long. > > My question, is what next? Where do I go from here to determine the > cause of this traffic, > > The other day, I had a machine on the core switch that was running an unusual amount of outbound traffic, I turned it off, and the traffic disappeared, but I don't think that's the final solution. > > The examples above are not typical of my network, but kinda make me wonder. Any insights that you can provide would be appreciated. > -- Unsubscribe mailto:[EMAIL PROTECTED] Archive http://www.ee.ethz.ch/~slist/mrtg FAQ http://faq.mrtg.org Homepage http://www.mrtg.org WebAdmin http://www.ee.ethz.ch/~slist/lsg2.cgi
