- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: Interface utilization is going 98% (recieved) ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Interface utilization is going 98% (recieved) in the VSX gateway
Hi All,
In of our Checkpoint box inetrface utilization is going 98%(recieved) so just want to know which which users are sending the most
traffic and try to catch them . Gateway is R77.30 and want to know the output just like "ip-accounting" in Cisco ...
Please require your support .
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All
One thing also want to add that eth1-06 is the physical interface of the VSX gateway which is showing 96% of recieved utilization
and no ip is configured on this . There are 7-8 VSs like checked vsenv 7--> eth1-06.2781 like this different VLANs interfaces belong
to different VSs.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Very basic, but have you tried tcpdump, often enough you can see high bandwidth users from tcpdump. Just explicitly set good flags to stop the capture and not to saturate CPU. I.e count, -c xxx
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for confirmation
What will be tcpdump command to identify high bandwidth users ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The tcpdump command would be something like:
tcpdump -i eth1-06 -c 1000
to capture a max of 1000 packets.
Make sure the scrollback buffer from your SSH program is set big enough to scroll back through those lines.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
But how we can identify which host or servers is taking most bandwidth or most packets like "ip accounting " in cisco ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
See the VSX-specific sections of these SK's, the short answer is you have to use CPMonitor:
sk164215: How to Detect and Handle Heavy Connections
sk122013: Handling heavy connections in CoreXL
sk167553: Performance Investigation Procedure - How To
now available at maxpowerfirewalls.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Regards
Magnus
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If we want to find the top source and destinations in interface wise . Can we do it through smartLog ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
well you do have the routing table/antispoofing so just filter on those prefixes(networks) first then smartlog will do new calculation on top source and destinations.
Regards,
Magnus
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How about using SmartviewMonitor and looking for top source, destination or service on the interface ?
Wolfgang