ip accounting

david_r

Can anyone point me to some detailed info on the cisco command "ip accounting"?

I'm getting a random , 10 to 20 minute flood of traffic that's maxing out a 5-T1 multilink. I'd like to know if I can use ip accounting to find out what is going on?

Thank you for your time

EdTheLad

I think you mean statistics? mtrg might be what you need,its a free application that uses snmp to monitor traffic.Do a search on google for more info.

wildfire

Ip accounting will also do what you want, but you need to tie it to an access-list otherwise like debug it can bring a router to its knees.

http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/products_command_reference_chapter09186a008017d169.html#wp1091971

If you have a good idea whats causing the flood then this can also be a useful tool for gathering statistics.

Yankee

If you are looking for the heavy talkers during that period, look into applying ip route-cache flow and then use the associated show command. It is a quick and easy way to look at stuff like this, but you must remember it is pretty much real time (think it is 15 seconds after the flow ends the info is removed from the output).

Yankee

darkuser

ahhhh

flow switching is my friend .....

Yankee

Welcome back, Darth. Ain't seen you around much

Yankee

david_r

ed,
We use SolarWinds and Intermapper but I'm looking for the top talkers. Maybe I just don't know how to pull that info.

wildfire, are you sure about it being like debug? I'd hate to crash a production router.

Yankee, I'll look into that. I'd really like something I can present to management and say, "I don't care what the LAN guys told you . Here's a pretty graph that shows they are flooding updates at these times."

Darthuser, Are you talking about NetFlow? It looks like it might just do what I want.

Thanks everyone for your help.