Latency at Internet Gateway w/Cisco 1600

[Mikeysos]

Hello.

For the last three - four weeks, we have experinced latency at our Internet gateway which is managed using a Cisco 1600 router.

Our ISP repeatedly reports that our bandwidth is being gobbled up by something. It is very sporadic so that overall at the end of the day, we report good ping times (of 88000 packets sent, we lost 47 of them and the average trip time is 53ms. But during we have intermittent spikes throughout the day that plays havoc with our Internet connection speed and our ERP which connects over the Internet to a server.

I have checked the connection between our router and the hosted ErP server router and

http://www.yahoo.com

and round that the latency exist there. Our ISP and local telco says it is a matter of over utilization of bandwitdh. I think it is a local system within our LAN doing something.

Symantec reports no viruses or trojans.

What it the best way to troubleshoot this? If I were you, what would you do?

TIA

 

[Narizz28]

Put a sniffer on it. There are free ones and pay-for ones. Personally, I use Netasyst (by NAI), which can be tried for free.

 

[lui3]

depending on the router that you have you can also use ip route cache flow statistics to view the connections that are hogging all you bandwidth.

enable ip route cache flow by using the flowing commands on the the interface you want to monitor. in this case you wan interface

interface xxxxx
ip route-cache flow

then at the exec prompt

show ip route-cache flow



or something like that

you may have to play with the syntax to get it to work

then you should be able to see the flow statistics for packets originating from your network and determine who is taking up all the bandwidth. like i said it will be best to do this while the hogging is taking place so that you can track down the source of the problem. make sure that you get the mac address of the user that is taking up the bandwidth if its on your lan by typing

show ip arp | include xxx.xxx.xxx.xxx


xxx.xxx.xxx.xxx being the ip address of the violating flow

this will return the mac address that you are having issues with and allow you to track it down even if their ip address change via dhcp or other.

good luck


sniffer will work too except if you have a switched network you will have to use a hub inline of the connection you want to monitor or configure your switch ports for port monitoring