• Skip to main content
  • Skip to footer

NetworkJutsu

Networking & Security Services | San Francisco Bay Area

  • Blog
  • Services
  • Testimonials
  • About
    • About Us
    • Terms of Use
    • Privacy Policy
  • Contact Us

show ip flow top-talkers

10/05/2011 By Andrew Roderos 7 Comments

  • Share on Twitter Share on Twitter
  • Share on Facebook Share on Facebook
  • Share on LinkedIn Share on LinkedIn
  • Share on Reddit Share on Reddit
  • Share via Email Share via Email

Who is hogging your precious WAN bandwidth? That’s probably one of the things that you’re asking on your mind when you receive an alert about a certain WAN link has reached its full capacity. Well, you’re in luck. In newer Cisco IOS, it will allow you to enable NetFlow and Top Talkers which gives you the ability to view who are the current top talkers in your network. I really believe that the commands that I am about to show you should be part of your standard configuration on routers.

To enable Top Talkers, issue these commands:

ip flow-top-talkers
 top 10
 sort-by bytes

Enabling Top Talkers is not enough, you also need to enable NetFlow on an interface. According to Cisco, if the router is running Cisco IOS prior to release 12.2(14)S, 12.0(22)S, or 12.2(15)T, the command used to enable NetFlow on an interface is ip route-cache flow. If the router is running Cisco IOS release 12.2.(14)S, 12.0(22)S, 12.2(15)T, or later the command used to enable NetFlow on an interface is ip flow ingress. However, I’ve used ip route-cache flow on a router running Cisco IOS 15.0 and it worked just fine. Try the first one first before using the latter. I have not tried it yet, but you may need to use ip flow egress as well if ip route-cache flow does not work.

In this scenario, I enabled NetFlow on Serial0/2/0.

configure terminal
interface Serial0/2/0
 ip route-cache flow

Once you are done configuring NetFlow on the interface, then you can now issue:

Router#sh ip flow top-talkers
SrcIf    SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Bytes
Se0/2/0  10.1.1.33    Fa0/0 10.2.2.9     06 050E 1BC7  2156K
Se0/2/0  10.1.1.140   Fa0/0 10.2.2.78    06 0A26 10C0  1629K
Se0/2/0  10.1.1.144   Fa0/0 10.2.2.55    06 0A26 0CA6  1352K
Se0/2/0  10.1.1.120   Fa0/0 10.2.2.77    06 0A26 05E8   535K
Se0/2/0  10.1.1.106   Fa0/0 10.2.2.86    06 0A26 086A   361K
Se0/2/0  10.1.1.131   Fa0/0 10.2.2.90    06 0A26 0A7A   135K
Se0/2/0  10.1.1.112   Fa0/0 10.2.2.80    06 0A26 0C28   109K
Se0/2/0  10.1.1.137   Fa0/0 10.2.2.80    06 0A26 0D95    75K
Se0/2/0  10.1.1.142   Fa0/0 10.2.2.82    06 0A26 120B    71K
Se0/2/0  10.1.1.116   Fa0/0 10.2.2.83    06 0A26 0922    47K
10 of 10 top talkers shown. 30 flows processed.

I really think this is a great tool to have in your routers. It will basically help you identify who is congesting your WAN link. I’ve seen scenarios where Security (Loss Prevention) guys, like to see what’s going on in the remote branch and they use their little PC to remotely view the security cameras inside the remote branch. In some environment, that’s a no-no especially if the mission critical applications are being affected. If the QoS (Quality of Service) was designed and implemented correctly, then you shouldn’t have to worry about Security guys viewing and streaming recoded videos because the mission critical applications should have guaranteed bandwidth when there’s a congestion.

I hope this has been helpful and thank you for reading!

Reference

NetFlow MIB and Top Talkers

Disclosure

NetworkJutsu.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.

  • Share on Twitter Share on Twitter
  • Share on Facebook Share on Facebook
  • Share on LinkedIn Share on LinkedIn
  • Share on Reddit Share on Reddit
  • Share via Email Share via Email

Filed Under: General Tagged With: Cisco, IOS

About Andrew Roderos

I am a network security engineer with a passion for networking and security. Follow me on Twitter, LinkedIn, and Instagram.

Footer

WORK WITH US

Schedule a free consultation now!

LET’S TALK

Copyright © 2011–2023 · NetworkJutsu · All Rights Reserved · Privacy Policy · Terms of Use