Path: utzoo!attcan!uunet!samsung!zaphod.mps.ohio-state.edu!usc!apple!veritas!amdcad!hobbes!cdr
From: cdr@hobbes.amd.com (Carl Rigney)
Newsgroups: comp.dcom.sys.cisco
Subject: Re: Cisco IP accounting
Keywords: snmp, accounting, cmu snmp code
Message-ID: <1990Nov8.230437.27637@amd.com>
Date: 8 Nov 90 23:04:37 GMT
References: <29409@boulder.Colorado.EDU>
Sender: usenet@amd.com (NNTP Posting)
Organization: Advanced Micro Devices; Sunnyvale, CA
Lines: 24

Has everyone forgotten the basic SNMP principle that agents should be
kept simple and the network management station should do any
sophisticated processing?  In an afternoon I wrote a perl script that
uses the CMU snmpwalk to retrieve the cisco accounting table, flag the
addresses it doesn't think are valid hosts, and print it out.   A pass
through sort and head then gives you the top talkers.  Drop me a line
if you want a copy.  If you only want to query for a given subnet,
that's easy if you subnetted on byte boundaries, almost easy otherwise.
I've got another program that does the same thing for etherfind, although
its more detailed and rudimentary.

It only took another afternoon to turn that data into a (so far,
static) SGI Net Visualizer style plot that shows all the connections,
colored to emphasize the biggest links.

Access lists are great, and accounting lists are OK if they don't slow
things down too much.  I know the temptation to merge routers and
network monitoring devices is strong because that way you need only
one box instead of two, but implementing a lanwatch algorithm in
hardware seems a little excessive!

--
Carl Rigney
cdr@amd.com