Tracking down a bandwidth hog on a PIX

[MysticLlama]

Is it possible?

I've been pulling my DS1 utilization graph from my PIX because it's built in to the web interface, auto updates, and works really well. The only shortcoming I can find is that I can see that someone is maxing the thing, but I can't find any way to see what IP the traffic is destined back to.

Is there any way to do this on the device without doing sniffing in between?

I do have a managed switch for the main one, so I guess I can set up a port to copy all traffic on, all of the others (including two that the user connects through) are unmanaged. Can I just look for the IP that most of the incoming packets from the PIX port are going to if I can't do it on the PIX itself?

Is there any good, (and pretty) software that I can use for monitoring stuff like this on an ongoing basis that doesn't cost a mint?

 

[Fuzznuts]

Flow scan will do what you need get it from http://www.caida.org/tools/utilities/flowscan/ its a bit awkward to get running but it will be able to do what you ask you will of course need a linux box to run it from.

enable snmp on your PIX an duse mrtg this may also be able to help you get mrtg from http://www.ee.ethz.ch/~oetiker/webtools/mrtg/

Hope this helps

 

[cmetz]

See if the PIX supports netflow, if it does, try it.

 

[spidey07]

netflow or "ip accounting" are quick ways to see the top talkers/receivers.

been a while since I messed with a pix but look up information on these two methods. They count bytes per IP address or conversation.

 

[SR]

Cheap and easy way is to throw kiwi syslog server and reportgen (syslog analyzer) on a microsoft box and run a bytes inbound and out bound report.

 

[MysticLlama]

The Kiwi syslog server and reportgen are working great, I've been fiddling with the other stuff too, but I'm not real adept at Linux, and trying to get MRTG running on Windows isn't the most straightforward thing in the world.

It's a little clumsy, but I think if I made a bunch of schedules up I could probably get at what I want easily.

There is also an option if you buy it to log to a database, and then I could have one of our web devs build me a front end someday, that would be pretty cool too.

Thanks for the help.