Script to capture top bandwidth users

[Graham Land]

Does anyone out there have a script that lets you detect when the utilisation of a particular interface goes above a particular threshold and then breaks down who's using this bandwidth?

I can detect the utilisation easily enough through SNMP in/out octets but I have no idea how to determine what's actually using the bandwidth?

Is this stored in a MIB somewhere?

Regards,
Graham.
points for all replies

[Les Ligetfalvy · Accepted solution]

Well... that depends.

I don't have a script for you and I am certain that those sort of details would not be exposed in simple OIDs. Depending on what model of switch you have and the level of RMON2 it supports, you could have the switch push the details to you. Nothing as simple as a script to pull them though. PCM+ does this as do other advanced NMS systems that support TopN data collection.

Even at that, the word "simple" as in SNMP is a bit of a misnomer as there is nothing simple about coercing the data out of the switch. It has been discussed here before and I have tried to get my Fluke software to gather TopN data from HP switches but unfortunately I have reached my level of incompetence.

[Graham Land]

Hi Les,

I'm dealing with cisco switches and routers.
They have netflow configured on them and I thought that I would be able to query TOPN details from their onboard buffer cache through the CISCO-NETFLOW.MIB.
This doesn't appear to be possible though.

Thank you,
Graham.

[Les Ligetfalvy]

Odd that you're looking for help on a HP forum for Cisco gear. :/

Anyway, here is the thread that I mentioned.http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=900791

I never did get my Fluke WGA to gather history stats from HP ports. What I am doing now is to mirror whatever port I am interested in to my Fluke WGA and then I read out the Fluke's own history details. It also lets me easily capture network traces that way.

All that said, I think you can find several software applications under GPL that will gather TopN from Cisco gear. Far better IMHO than trying to cobble together your own code.

[Graham Land]

Cheers