topic Re: Finding high bandwidth user in General Topics

Finding high bandwidth user

handiansudianto — Sat, 01 Apr 2023 01:27:12 GMT

Hello,

can we know who user or ip which consume high bandwidth?

Re: Finding high bandwidth user

the_rock — Sat, 01 Apr 2023 01:31:56 GMT

You can generate app control report or if you have monitoring blade enabled, you can probably see it there as well. Also, you can try run command fw ctl multik print_heavy_conn from expert mode of the firewall.

Andy

Re: Finding high bandwidth user

handiansudianto — Sat, 01 Apr 2023 01:35:13 GMT

hi..

did you mean top source on monitoring blade?

Re: Finding high bandwidth user

the_rock — Sat, 01 Apr 2023 01:37:11 GMT

That makes sense...sorry. dont have access to the dashboard, but you can see all the options once you open it. Im fairly sure there are some values there for top bandwidth users, src, dst...

Re: Finding high bandwidth user

handiansudianto — Sat, 01 Apr 2023 01:40:04 GMT

here screenshot of monitoring blade

Re: Finding high bandwidth user

the_rock — Sat, 01 Apr 2023 01:42:51 GMT

So .66 is top source and you can also check top users all the way at the bottom, that should give you more info as well.

Re: Finding high bandwidth user

the_rock — Sat, 01 Apr 2023 01:49:41 GMT

Just as a reference, things I usually point out to people in cases like this

-always check monitoring blade, if its enabled

-if monitoring blade is not enabled, see if any report can be generated (though you may need to have smart event enabled for that)

-in some cases, compliance blade may also help, though that needs additional license applied to the management server

-commands such as fw ctl multik print_heavy_conn or cpview (just tab between different fields) can also be useful

-cpstat command can also give some insight, when you run it, it gives all the options/ So say you could run cpstat fw -f all, you run command from 2nd row and then -f and flag from last column in the table (its very useful)

Hope that helps.

Have a nice weekend!

Andy