Tracking down high bandwidth users

When your internet bandwidth is being maxed out, it's nice to have an easy way to determine which users are causing the problem. One way of doing this is by using Netflow statistics. One free toolset to collect Netflow data is called flow-tools.

If you're using ASA FWs, a quick and dirty way to check out the offending users is to use the built in statistics in Cisco ASDM. This is located on the firewall dashboard as shown below



On this dashboard is a "top usage status" box that shows the offending user IP addresses along with the percentage of bandwidth used. This is shown below



This data can be used as a starting point for tracking down the high bandwidth users on your network