today I found out that somebody in our organization utilized our uplink for 100%. We have Cisco WLC 2500 where I could see in application monitoring that 80% traffic of the last 90 sec was a file hosting service traffic. So, somebody had been downloading some big file. I will try to configure QoS for bandwith limitation but here is a question - how can I find in real-time who utilizes the bandwith?
The easy way to do it could be:
On your WLC home page you should have something like:
You can reset the stat through the gear icon on the top right corner, selecting "Clear Dashboard Data"
Then the machine should quickly appear in the "Top Client Devices" list, you can click on it and you will get the IP address and the mac address of the device.
Bonus if you use Radius / NPA authentication, you could see directly the user which is authenticated on the device.
Unlike IP addresses, that are often dynamically allocated, MAC addresses are unique identifiers that can be used to reliably identify hosts in your network. Flexible NetFlow allows collecting VLAN IDs or MAC addresses. https://www.noction.com/blog/finding-mac-addresses-using-flexible-netflow