Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sdd.hp.com!zaphod.mps.ohio-state.edu!sol.ctr.columbia.edu!ira.uka.de!i32fs2!nipper
From: nipper@i32fs2.ira.uka.de (Arnold Nipper)
Newsgroups: comp.dcom.sys.cisco
Subject: Re:  Cisco IP accounting
Message-ID: <90.313.10:19:17@ira.uka.de>
Date: 9 Nov 90 10:19:17 GMT
References: <29341@boulder.Colorado.EDU> <3230@medusa.informatik.uni-erlangen.de>
Sender: news@ira.uka.de (USENET News System)
Reply-To: nipper@i32fs2.UUCP (Arnold Nipper)
Organization: University of Karlsuhe, West-Germany
Lines: 40

In article <3230@medusa.informatik.uni-erlangen.de> eckert@medusa.informatik.uni-erlangen.de (Toerless Eckert) writes:
>From article <29341@boulder.Colorado.EDU>, by pte900@jatz.aarnet.edu.au (Peter Elford):
>
	[ stuff deleted ]

>Another question: with a little programming (well, maybe a bit more)
>one could write nice programs using frequently retrieved accounting data to
>calculate traffic dispersion between different ip connections. For example
>sampling the accounting data every 5 minutes, and subsampling the host/host
>pairs that produce most network traffic could provide a nice 'top' tool
>for monitoring. Has anybody done these kind of things ?

I wrote a short awk script producing a top x list of host/host pairs.
Input data for awk is retrieved by Daniel Karrenbergs program to get 
IP Accounting from the cisco via a telnet like session. Output looks like:

	TOTAL			bits/s	KByte
	shost   dhost		  %     KByte
	shost   dhost             %     KByte
	shost   dhost             %     KByte
	...     ...		 ...	 ...

TOTAL means total throughput over all interfaces. % is the percentage
of the shost/dhost connection where 100% is the TOTAL throughput. I use
the "Accounting data age is" line to calculate bits/s. This is reasonable
if the polling period is long enough but will give quite incorrect data
when the period is short. But anyway the % still holds and gives a good
look of which host/host is consuming most of the bandwidth. The list length
can be set by specifying the percentage to which you want to see 
shost/dhost pairs e.g down to 10% of total throughput.
I would like to have accounting data indexed by interface number too.
Than it would be easier to compute bandwidth consuming of each line
connected to you cisco. OK, I know, this will not reduce memory consumption
for IP accounting but I think this would be a nice feature.

Arnold
********************************************************************************
Arnold Nipper *** Universitaet Karlsruhe, Am Fasanengarten 5 * nipper@ira.uka.de
XLINK, Inst. fuer Betr.- und Dialogsysteme, D-7500 Karlsruhe *  +49 721 608 4331
********************************************************************************