Sniffing PPP Link

[snootalope]

Hello

Routers: Cisco 1751 with IOS 12.2(15)ZJ2

I'm getting really frustrated.. I'm trying to find out what exactly is taking up so much bandwidth accross my PPP Links. I'm on a LAN segment of 10.x.x.x and it's using 192.168.x.x.. I don't know if that makes a difference or not, but I can't seem to find the traffic that's going across there..

I tryed the "debut ip packet" on my central router, but it crashed the damn thing and my satelite offices went down.. so that's not happening again..

I got packet sniffers and what not, but I need to know how I can get that specific traffic stream.. anyone know how?
snooter

"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[rn4it]

What kind of link is it? Frame relay? what are the sizes and how do they connect into the central router? Two things to out for are a) CIR (Confirmed Information Rate)- This is the minimum garenteed bandwidth by the telco. You could have a 256K pipe, but it might only have 16K CIR, which means during busy hours the Telco only needs to supply you with 16K. b)the connection coming into the central router isn't large enough. For example you have 5 satellite site that connect into a central router with a single connection to the telco. The satellite site each have a 128K frame circuit and the central routers connection is 256K. If you add up the satellites it adds up to 640, so you have a bootleneck at the Central router. I would eliminate any bottlenecks first.

 

[snootalope]

It's an FR link, yes, and it's a serial interface on the central router that connects to a full T1 backbone.. The CIR's of the two links I'm concerned about is 128k.

Just viewing the link via the "sh int s0/0" command I can see a steady input/output of AT LEAST 60k. Now I only have like 10 users TOP in each office.. their not even running PC, their just using winterms..

Maybe it is right where it needs to be, but I'm more concerned with "seeing" the packets that are filling up each line than assuming what it is..

"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me