0

We are going to set up a new office in a new location our concern is that if there is a network flooding or too much bandwidth is being used can we identify the culprit without DOS'ing the in-house server.

there will be 90 pc's with one Cisco sg-300 28pp managed switch and four un managed switch to connect all of them

Rough Network design

We will have 4 vlans for different departments Marketing, Ruby, DotNet and Servers in case of a network flooding or storm before we had no option as the switches were all plug n play now we have decided to segment into different vlans to control broadcast and minimize network outage.

so if any of the pc is flooding the network can we pin point the ip or the pc without having to go through all one by one?

EDIT : The Router is Cisco's RV016 Multi-Wan VPN Router.

EDIT2 : Now we have seven SG300-52 managed switches to operate and configure network.

Improve this question
2
  • 3
    In theory, you can use Netflow on the router to identify the culprit, depending on the model of your router. But let me make a general observation: You're trying to manage your network (that's a good thing), but you're using the simplest of devices that aren't designed for controlling and monitoring. The companies that manage their networks well use higher end routers and switches that have more features for monitoring and control. In other words, if you want to effectively manage your network, you're going to have to up your game.
    – Ron Trunk
    Apr 28, 2017 at 12:13
  • I know this setup is far from okay for any monitoring, our boss is trying all the new stuff under the budget and he wants a setup like this and also to have the monitoring capability to isolate the issue within minutes so that there's almost no downtime, it's impossible explaining my boss, so we are stuck to this issue.
    – NetAdmin
    Apr 29, 2017 at 6:30

2 Answers 2

Reset to default
1

Assuming you still have a port open on your SG300, you can use port mirroring/SPAN port to send a copy of all the traffic currently going to your router out another port. Then you can attach a sniffing monitor to that port. There are several options out there, but I don't have any experience with them (at least not in this capacity), so I'm not going to comment on their functionality. The first two I found are BandwidthD and PRTG.

http://bandwidthd.sourceforge.net/

https://www.paessler.com/manuals/prtg/packet_sniffer_monitoring

Improve this answer
1
  • It seems plausible, but from that day till now we have persuaded our CEO to get Managed switches at all level and now we have seven SG300-52 managed switches to operate and configure the network.
    – NetAdmin
    May 5, 2017 at 11:59
0

I think you are being silly with your hardware choices, buying one expensive cisco switch and a bunch of totally unmanaged ones. Even something like a TP-Link "smart" (note: not "websmart/easysmart") switch would be better than an unmanaged switch. If money is tight I would much rather have some level of management on all my switches than one switch with great management and four with no management at all.

In general managed/smart switches have the ability to monitor traffic on individual ports (either through the switches UI or through SNMP) but they typically don't offer higher level monitoring. So if you have some level of management on all your switches you can easily see which computer is the problem. If you don't then all you will see is which unmanaged switch the problem computer is on, with a handful of machines on one desk connected to an unmanaged switch that is tolerable but with 20 odd on one unmanaged switch it will be a massive PITA.

Some routers are able to monitor on the basis of IP addresses but since you tell us nothing about your router we don't know if yours can. Furthermore even if monitoring on the router is possible it will tell you nothing about traffic that remains within a VLAN and never hits the router.

Improve this answer
3
  • This doesn't answer the OPs question, although it's a perfectly valid as a comment.
    – Ron Trunk
    Apr 28, 2017 at 12:43
  • I have revised and extended the answer. Please reconsider your downvote.
    – Peter Green
    Apr 28, 2017 at 13:07
  • The Router is Cisco's RV016 Multi-Wan VPN Router.
    – NetAdmin
    Apr 29, 2017 at 6:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.