After a day of super-slow network performance, I found that one computer was both uploading and downloading gigabytes of data.

To find this, I had to pull up a list of the IP addresses by usage ,and then go desk to desk to find the culprit.

Can I setup Cisco EEM to monitor network (LAN/WAN) usage by IP address, and send an email to me if an IP address crosses X threshold? This would have let me at least start my day with the problem.

Hardware: Cisco 891

  • 2
    EEM will email you or perform other action as long as you "get the trigger". For getting there and setting a threshold I suggest you do this with netflow top-talkers. Here s a start: 1. enable 2. configure terminal 3. ip flow-top-talkers 4. top number 5. sort-by [bytes | packets 6. cache-timeout milliseconds 7. end Then you would have to run show ip flow top-talkers at any 60s and parse the results agains your network threshold.
    – laf
    Nov 4, 2013 at 9:38
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 9, 2017 at 15:44

1 Answer 1


Sure, there are lots of ways. The simplest way is to have EEM track the port usage by having it do a 'show ip interface' and use regular expressions to get the current traffic statistics.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.