We are observing a high interface load (spikes up to 1G) on a WAN (dedicated link) uplink port of a Cisco switch. How can we find the IP of the client that is causing this high load?

I have done some research before asking: I have looked at NetFlow manual, but could not find any examples of matches relevant to my problem. Also, we don't have a network monitoring host to send the traffic to. I have also come across IP Accounting, but it is deprecated for our switch.

This is a new install.

Our hardware is Cisco Nexus 5672UP, 7.3(0)N1(1)

Could someone please suggest a set of commands (potentially involving NetFlow in cached mode) to get from an interface name to a table of IP addresses with their transient bandwidth usages?

  • What is the switch model and IOS version? You should look at the Network Engineering Question Checklist for guidance. – Ron Maupin May 29 '18 at 14:06
  • You should be able to monitor excessive usage on your firewall. – Zac67 May 29 '18 at 14:53
  • @RonMaupin Thank you, I have updated the question – Tony Sepia May 29 '18 at 15:28
  • @Zac67, thank you, but on that segment of network there isn't a firewall – Tony Sepia May 29 '18 at 15:29
  • OK. You now have me confused. You claim it is Cisco IOS, but it is really a Nexus switch that does not use IOS, it uses NX-OS. Those are very different things. – Ron Maupin May 29 '18 at 15:30

Netflow is supported on the 5600's but NXOS doesn't provide the same local information that IOS does (ex: no show ip cache flow equivalent).

You'll need to collect the Netflow on an external host and run something like a top-talkers query. There are a ton of commercial and open source tools for Netflow analysis but bear in mind that the 5600 only supports sampled Netflow. This isn't a big deal for your use case and most modern Netflow analyzers support sampling.

  • Thank you! I have accepted the answer. Any chance of you providing a set of commands (like the question mentions), so that I can see an example of how to configure matches for this particular problem? I don't want to make them too broad, but instead see a good example for configuring them to relay the minimum required metrics. – Tony Sepia May 30 '18 at 9:31

There might be some other solutions to your problem. Netflow is one way. Another keyword could be "ip accounting" but you have also to read the manuals. For a quick look and if you have the possibillity to configure a monitor/span port, you can use an ordinary laptop with wireshark to get the information needed.

  • Thank you, that is a good piece of advice. I was hoping to find a sequence of NetFlow configuration commands (for local cache, not sending to monitoring server). Something that would keep only the essnetial bits of information that we need to get the answer – Tony Sepia May 29 '18 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.