Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm dealing with a high bandwidth situation and need to determine what host is sending / receiving the most data.

How can I get the logs necessary that will contain this information? I'm OK with parsing or writing code to do so, but I'm unsure of how to extract the information.

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

If you have the ASA firewall's ASDM interface enabled, you can view basic stats in the "Firewall Dashboard". Protocol, sources and destinations are easily viewed.

enter image description here

share|improve this answer
add comment

These devices support Netflow data collection as well as SNMP.

You can use a tool like Paesslers to view the data.

share|improve this answer
    
Does netflow use a method other than SNMP to gather data? –  makerofthings7 May 3 '12 at 14:09
    
Yes it is a separate protocol configured in your switch or router, and exports flow data to a collector. –  user119815 May 3 '12 at 19:59
    
@makerofthings7 netflow is it's own protocol, generally you need both netflow port 9996 and NBAR which is collected via SNMP to get the most accurate information. –  Zypher May 3 '12 at 20:10
    
Adding to Zypher's comments, NetFlow on ASA is not used in the same way as it is on IOS. Most devices that use NetFlow (such as IOS) will "sample" network traffic and periodically send data about that sample to an external collector or aggregator, which in turn can report on the data. ASA uses NSEL (NetFlow Secure Event Logging), which in some sense means it shoehorns syslog messages into NetFlow packets. For collectors that can deal with it, it does provide some useful information, but it isn't really useful for point-in-time utilization stats. –  James Sneeringer May 3 '12 at 20:16
add comment

Like Willy says the ASA's do not support Netflow, however if you need a longer term data collection solution, they do support a subset of Netflow data called sFlow. It doesn't have all the bells and whistles of Netflow, but you definitely can see over time who is using what bandwidth on what port.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.