Need to read this again to be sure, but here are some options: Multiple NICS - each one monitors a different ISP connection - two different SPAN sessions
Host Clusters. Not much doc here, but easy once you figure it out. Not sure if it would work for you though as the source and dest IP can be the same on both links - right? Or, are your source - your company's IP's - different depending on which link they use? get netflow working? :) If you don't care about what types of traffic and just want to see volume stats, use MRTG or similar SNMP tool to trend ifOctets in/out on each ISP int. use show int on routers and look at traffic. There's packets tx/rx, bytes tx/rx, 5 minute loads - that can be changed. If both routers are connected to both switches, one of the ports should be blocked via STP - so make sure you are SPAN'ing the active/forwarding port(s) Gary >>> [EMAIL PROTECTED] 10/25/2006 12:11 PM >>> I'm not sure NTop can show me this, but if it can, please tell me where to look first. We have two Internet connections via two ISPs. Both ISPs are aware of our ASN, but the pipes are not equal so one ISP is supposed to be "favored" over the other. The ISP connection that is not supposed to be favored has all of our internal users routed over it. It is the busiest connection (and the smallest pipe). I'm convinced that MANY of our customers and Internet users are actually using the smaller pipe - but I'd like to verify that. I would like, in fact, a way to display it graphically. My current NTop implementation is on a SPAN port on a small switch. That router for the small ISP connection has two ethernet ports, the primary of which is plugged into the same switch as NTop. This switch is also trunk port connected to another switch that has the bigger ISP router connected to it (though both routers are plugged into both switches). Therefore, I'm probably seeing some of the traffic going through the other switch/ISP router but not all of it. If I create an RSPAN for NTOP on that second switch I'm guessing there is going to be some overlap...hell, I just am not sure where to put NTop to see EVERYTHING and also differentiate - hopefully - between traffic coming over the two ISP connections. Though the smaller connection gets more traffic, and the bulk of that traffic is incoming, if we're controlling it correctly I should find that traffic to be mostly downloads initiated by our internal users... _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop =========================================================================== "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
