Which Users are pulling the most Bandwidth on your Network? Find Top Talkers on your Network-With 4 Easy Commands.
A slow sluggish network is one of the most frequent complaints received by network administrators.
The most common cause of this a slow user experience is Link Saturation, or link chocking. Wether it’s an Internet link that is being used to full capacity or a Remote Branch link that has been maxed out, we often experience poor performance on the LAN because of over-utilization of one of our links.
A quick easy way I have found to pinpoint which user on your LAN is abusing your network resources (often someone downloading Torrents) is to use the ‘Top-Talkers’ and the ‘Flow’ feature on your CISCO router.
Top-Talkers will allow you to collect data about traffic flowing from one part of your network to another, for e.g traffic coming from your LAN and exiting your network going out to the internet. The data collected includes the Source and Destination IP address as well as the amount of traffic being pulled by that host device.
With this information you can pinpoint which user IP address is using or abusing network resources. Let me show you how to configure Top-Talkers in 4 easy steps. The commands below are the actual commands I have used countless times on my organizations routers to find out which users are mis-using network resources.
Step #1 Enable Top-Talkers
R1(config)# ip flow-top-talkers
~Enables Top-Talkers Feature
R1(config-i)# top 20
~Allows you to collect data on the 20 highest users flowing through the router
R1(config-)# sort-by bytes
~You can sort or display your data by Bytes, or number of packets used etc
R1(config-)# exit
Step #2 Apply Top-Talkers to Local Interface
R1(config)#interface g0/0
~We enabled flow to be collected on the Interface that Connects our LAN
R1(config- if)# ip flow ingress
~This will monitor traffic flowing into this interface
R1(config-if)# ip flow egress
~This will monitor traffic flowing out of this interface
Step #3 Apply Top-Talkers to Local Interface (for Older IOS Versions)
On routers running older IOS versions, the above command will not work. In that case use the command below to enable traffic monitoring on your Device’s local interface.
R1(config)#interface g0/0
~We enabled flow to be collected on the Interface that Connects our LAN
R1(config-if)# ip route-cache flow
~This will monitor traffic flowing through this interface
Step #4 Pull out the Data
Once the above steps are complete, use the following show command to see the 20 users on your network who are pulling the most network resources.
R1(config)# sh ip cache flow
~For routers with an older IOS
R1(config-if)# sh ip flow top-talkers
~To show your Top 20 on newer IOS
To Wrap it Up
After using the simple commands above, give your router about 5 minutes to collect some data about the traffic. Then use the show commands in STEP #4 and presto, your router will spit our details about the 20 most active users on your network. At this point, you can easily manage your users and ‘restore balance to the force’ (some star wars humor). Lol.
For a more detailed explanation, see CISCO’s explanation on how to configure top-talkers.
Feel free to reach out if you have any questions you need to be answered. We are always happy to help.
About The Author
About The Author
William is a Network Engineer working in the Financial Sector as an Infrastructure and Network Administrator. Passionate about technology, he also runs a company providing a range of tech services for small, medium, and large organizations. William leverages 9 years of experience in the tech industry and has a passion for entrepreneurship with the goal of providing quality products and services to his customers. He also believes in sharing knowledge to grow the industry and help others. He maintains a blog as well as publishes ebooks to share what he has learned in his life and career. William Holds a Bachelors Degree in Computer Science (BSc) and a Huawei HCIA Certification in Routing and Switching.