Questions tagged [monitoring]

This tag is suitable for questions about or involving network monitoring as implemented on network devices or monitoring tools used by network professionals. Examples: IP SLA, SNMP, Netflow etc.

Filter by
Sorted by
Tagged with
26
votes
4answers
109k views

How can I capture traffic on Cisco IOS switches?

For investigating a problem in client to server communication, I need to capture packets for analysis. However it's not allowed to install a packet analyzer, such as Wireshark or tcpdump, on client or ...
22
votes
4answers
67k views

What is the difference between netFlow and sFlow?

How is sFlow different from netFlow, and how is each supported by different vendors ?
18
votes
3answers
27k views

How do you know if a Cisco switch is handling traffic well?

I have just read Jeremy's question about 2960-S and iSCSI traffic handling, which drove me to ask this question: We all have lots of switches deployed in distinct infrastructures, how can you know ...
14
votes
3answers
3k views

Why we get high fluctuation on bandwidth measurement Cacti graph?

We were on redundancy test of Etherchannel and Routing on our network. During this intervention we made some measurement. Our monitoring tool is Cacti for graph. The equipment monitored is a 4500-X ...
13
votes
4answers
6k views

Hardware tap vs port mirroring - Any limitations?

I predominantly work in a Cisco environment and contemplating buying a network tap device for use with Wireshark. Can anyone provide the pros and cons from their experience between using network taps ...
11
votes
6answers
6k views

Weather map and monitoring for network usage [closed]

What tools are able to provide an almost real time weather map of usage and average traffic per timeframe going over the different links? What are some ways or solutions to actively monitor my ...
10
votes
2answers
3k views

How does nmap distinguish closed ports from filtered ports

Let's suppose we are doing a TCP connect scan. a nmap scan on google returns the following output : PORT STATE SERVICE 80/tcp open http 443/tcp open https However, if I try to ...
9
votes
4answers
2k views

Measuring per-link latency/jitter/packet-loss

I need to measure the latency, jitter and packet-loss per link in a network, as opposed to end-to-end, e.g. like this: s1-eth0 <--> s2-eth0 (~ 20µs avg. latency, standard derivation 10µs, 57 % ...
9
votes
5answers
10k views

Monitor specific traffic type on a Cisco router

Is it possible to monitor a specific traffic type going through a cisco router? (like monitoring via wireshark) Ex: I want to monitor http traffic specifically that is passing through a router. (or ...
8
votes
2answers
510 views

Determining optimal bandwidth needs for the office

We're currently using the Cisco 1921/K9 router along with SG300 L3 switch and other L2 switches in the office environment. We're hooked up to a 10M fiber line for internet but not sure if we need that ...
8
votes
2answers
17k views

How can I capture traffic on a Brocade XMR, MLX, CER or CES?

How can I perform a packet analysis on traffic flowing through a Brocade XMR, MLX, CER or CES without having to install a specific software on any of the remote endpoints ?
8
votes
1answer
6k views

Remote sniffing with ERSPAN to the desktop

I know how to use both SPAN and RSPAN. If I'm not wrong, ERSPAN leads us to the possibility of remotely monitoring a router through an IP network and a GRE tunnel. However a tunnel end-point is needed....
8
votes
2answers
2k views

SNMP Monitoring Juniper EX8216 switches for Rx/Tx power, temperature and bias current

I am trying to monitor individual transceivers on two EX8216 Juniper switches regarding the following parameters: RxPower TxPower Bias Current Temperature The methodology I am ...
7
votes
5answers
3k views

Cisco: monitoring users input

Is there a way to monitor a user's input on a cisco device? Clarification: the commands a user have entered as in configuration mode AND normal mode. (especialy normal mode. Configuration mode can ...
7
votes
2answers
2k views

Monitoring without Port Mirroring

A quick overview of the problem We've been experiencing some issues with our bandwidth usage lately which I fear may be due to misuse (whether intentional or not) of our internet in the office. I ...
7
votes
1answer
3k views

How to get ipfix working with openvswitch? [closed]

I'm trying to monitor my OpenVswitch via IPFix. But I'm banging my head against a brick wall for two days now :/ According to the ovs-vsctl manpage I need to add a new entry into the config-database, ...
6
votes
6answers
2k views

Monitoring Network Traffic

I currently make use of a NETGEAR FVS338 firewall and a NETGEAR 24 port switch. Is there a way to graphically or in some way monitor their traffic? Edit: Switch Model FS726T
6
votes
2answers
2k views

How to monitor(SPAN) traffic on only a single port of a LACP trunk in Brocade Fastiron

How can you monitor(SPAN) traffic on a only the primary port or a secondary port of a LACP trunk on a Brocade Fastiron? I can put the monitor command on the primary port e15 and it will allow me to ...
6
votes
3answers
1k views

RA VPN notification

I've got a vendor that supports some specialized equipment, the network engineer before me set them up with remote access VPN terminating to a Cisco ASA 5510 so they can remotely administer/...
6
votes
3answers
2k views

Monitoring best practice for thresholding errors on an interface?

When monitoring interface errors, what percentage of traffic should you set your 'critical' threshold to according to best practices and does it depend on the interface type (T1, Ethernet etc)? It ...
6
votes
1answer
2k views

Daily, Weekly and Monthly Reports from Solarwinds?

I'm working with a Solar Winds NPM/NTA/IPAM golden-trio. I'd like to customize our reports to the point where I can received daily, weekly or monthly emails for various things - 95th percentile errors,...
6
votes
5answers
3k views

How to check MPLS connections?

I monitor about 150 routers with MPLS links. To check if connection is established, I'm pinging loopbacks visible only from WAN. If a loopback is not responding, I can see which link is not working ...
4
votes
3answers
8k views

Using wireless cards in promiscuous mode

I have encountered problems trying to catch packets in promiscuous mode from a wireless interface. I have used various adapters on different platforms, but i can only catch packets destined or ...
4
votes
2answers
2k views

Decoding wpa-psk traffic with Wireshark

I want to plot how much data each client is using from a wpa-psk protected access point (that I control). For that I intend to monitor all traffic for a couple of days. However I can't decode the TCP ...
4
votes
2answers
243 views

Cisco 1142: Gather “show int dot11Radio N statistics” Data via SNMP?

I have a Cisco 1142 access point and would like to collect the statistics shown by the command "show int dot11Radio [N] statistics" command via SNMP. Specifically, I want to collect the number of ...
4
votes
1answer
217 views

Can I get what filters are applied to an interface via SNMP?

I have some firewall filters on juniper devices- ex3300s make up the majority of them. I've been looking for an oid that will let me associate an IFL with the filters that are on it, and I've yet to ...
4
votes
1answer
331 views

ScreenOS: See Peak bandwidth on an Interface and Alarm if it crosses a threshold

I have a Juniper SSG320M running ScreenOS 6.2 (actually 2 of them in an HA active/passive). I want to measure the bandwidth consumed on one of the interfaces, and throw an alarm if that exceeds a ...
3
votes
3answers
283 views

Broader Impact of enabling “preserve source address” inside NLB

Can anyone explain what the impact is of enabling “preserve source address” inside the Network Load Balancer? Our customer’s NLB vendors are; F5 Netscaler I've been asked this by one of my customers....
3
votes
2answers
1k views

SNMP configuration on a Cisco switch

I need to configure SNMP on a Cisco switch and link it to SNMP 1.1.1.1 SolarWinds server. Please suggest commands for the switch. We are using SNMPv3 with MD5 auth entication.
3
votes
2answers
2k views

What is the best way to monitor individual APs on an Cisco 5508 WLC?

I need to generate a notification for APs that have lost connectivity so that we can proactively dispatch a tech to troubleshoot. We have about 150 APs on our controller. Looked into Cacti and PRTG, ...
3
votes
2answers
1k views

Extract QoS Buffer Drops via SNMP

I am in the process of rolling out solarwinds for visibility of QoS performance using netflow and CBQOS to show QoS class usage. One thing I am unsure of is what type of monitoring is available on L2 ...
3
votes
1answer
434 views

Cisco router dot1Q monitoring

How can I monitor on a Cisco router if dot1Q packets arrive on the trunk interface or if others arrive on that interface (like ISL, the old protocol of Cisco)? How can I do this and what is the best ...
3
votes
2answers
2k views

A way to monitor IPsec tunnels? [closed]

Can anyone recommend a good way of setting up monitoring of IPsec tunnels via SNMP for example? VTI-tunnels are very easy to monitor since there are no difference from any other virtual interface, but ...
3
votes
1answer
313 views

EEM to send email for problematic IP address

After a day of super-slow network performance, I found that one computer was both uploading and downloading gigabytes of data. To find this, I had to pull up a list of the IP addresses by usage ,and ...
2
votes
2answers
353 views

Sampled Netflow

i have configured netflow in my router but my router is overheaded. So i decided to configure sampled netflow and sampling rate of 1 out of 100 packets may reduce the export if Netflow data by as ...
2
votes
2answers
252 views

Finding the available capacity on switch interface in bytes or bits

Below is the output from my "show interface " command PE1.18:01:44#sh interfaces Ethernet 3 Ethernet3 is up, line protocol is up (connected) Hardware is Ethernet, address is 001c.7374.3d95 ...
2
votes
1answer
1k views

Send command lines to syslog server

I already can send each Linux command line to my syslog server. Now, I'd like to send each command line inserted onto my Cisco router to syslog server. Is it possible? If yes, how?
2
votes
1answer
1k views

Netflow on all interfaces?

I'm reading up on Netflow and playing around in PacketTracer. Currently I'm using ip flow ingress/egress only on my Routers gigabitEthernet. How much overhead is required, is Netflow supposed to be ...
2
votes
4answers
130 views

How would you discover hosts on a network if they have stateful firewalls set up?

I've been wondering how it would be possible to accurately map a network using something like nmap and discover hosts on the network if those hosts have stateful firewalls set up that filter packets ...
2
votes
2answers
112 views

Capturing traffic from multiple connections on a switch

Consider the traffic monitoring setup on the bottom of this page: https://www.ntop.org/pf_ring/port-mirror-vs-network-tap/ The two lines of a network tap are connected to a switch which merges the ...
2
votes
2answers
2k views

Cisco 3560 interface counters, are the counters reset automatically?

I have a Cisco 3560G switch. Are the interface counters reset automatically, recalculated in a specific interval (5 minutes?), or not at all? I want to get (hourly, daily, monthly, etc) interface ...
2
votes
2answers
3k views

Netflow vs sampled netflow

I'm working on a project where I could need Nexus 5600. These switches support sampled netflow and not netflow. I would like to use netflow to do stats and to analyze trafic at some specific times. ...
2
votes
1answer
2k views

Using Wireshark for traffic capturing in promiscuous mode

I am new to networking; so far we learned about the OSI model, packaging stuff, Wireshark, and network troubleshooting. As I have had understood, Wireshark is able to capture all packets by going to ...
2
votes
1answer
316 views

Cisco: Can (and should) I monitor the processing and memory load of QoS on a router?

In the lab I have some 7206VXRs (and 7301s, but lets concentrate on 7206 for now) which are acting as PE routers. I wish to test some basic QoS policies on these for customer facing VoIP services. On ...
2
votes
1answer
7k views

Cisco Prime NCS not starting

I have received the Cisco Prime OVA file and which we placed onto an Oracle virtual environment. We turn the VM on and the CLI boots, When we try to start the NCS service we get errors. HOSTNAME/USER#...
2
votes
1answer
422 views

hashing part of a packet/frame to identify duplicate packets

Consider an application (mostly TCP/UDP, but not strictly so) where the packet sizes vary, and may be very long. The use case / problem statement is to identify duplicate frames that are collected at ...
2
votes
1answer
92 views

Routing and Switching & network monitoring

hi i am facing problem in juniper switch Model: ex4200-48t ,Junos: 15.1R6.7 . i deploy network monitoring check-MK software. there is showing errors of juniper switch ports and also show in logs file ...
2
votes
1answer
685 views

What field tells me the bytes in IPFIX?

In netflow there are in_bytes and in_pkts fields. What are the equivalent values in IPFIX? I'm shipping IPFIX data with softflowd and I'm getting these fields: destinationIPv4Address ...
2
votes
3answers
555 views

Arista switches- Email alert if interface status changes

I'm looking to be notified of interface state changes on my Arista switches without my manual polling of the logs. For example, tailing var/log/messages, I might see something like: un 29 19:10:48 ...
2
votes
1answer
508 views

Nmap doesn't see every reachable host

In my company there are 3 switches: x.x.x.8 x.x.x.9 x.x.x.10 I monitor them on Netsight, sometimes with nmap, and of course pinging. They are visible on Netsight and reachable by ping. I can log ...