Finding high bandwidth user

[handiansudianto]

Hello,

can we know who user or ip which consume high bandwidth?

[the_rock]

You can generate app control report or if you have monitoring blade enabled, you can probably see it there as well. Also, you can try run command fw ctl multik print_heavy_conn from expert mode of the firewall.

Andy

[handiansudianto]

hi..

did you mean top source on monitoring blade?

[the_rock]

That makes sense...sorry. dont have access to the dashboard, but you can see all the options once you open it. Im fairly sure there are some values there for top bandwidth users, src, dst...

[handiansudianto]

here screenshot of monitoring blade

[the_rock · Accepted solution]

So .66 is top source and you can also check top users all the way at the bottom, that should give you more info as well.

[the_rock]

Just as a reference, things I usually point out to people in cases like this

-always check monitoring blade, if its enabled

-if monitoring blade is not enabled, see if any report can be generated (though you may need to have smart event enabled for that)

-in some cases, compliance blade may also help, though that needs additional license applied to the management server

-commands such as fw ctl multik print_heavy_conn or cpview (just tab between different fields) can also be useful

-cpstat command can also give some insight, when you run it, it gives all the options/ So say you could run cpstat fw -f all, you run command from 2nd row and then -f and flag from last column in the table (its very useful)

Hope that helps.

Have a nice weekend!

Andy