If ntop doesn't work for you, you could turn ip accounting on in the router, which will show you number of bytes for each pair of IP addresses that have had a conversation: conf t interface ethernetX ip accounting (or ip accounting output-packets if you think it's download traffic, OUT the ethernet interface TO your network) end wait a few minutes show ip accounting If you have a busy network, an easy way to see who's using what would be to get the sho ip accounting output into a file (use typescript, or copy-paste or whatever), and pipe it through sort, telling sort to use field X (the "bytes" column) as the sort key. Usually the culprit is very obvious, even without sorting the output first (just look at what conversation was highest relative to the others, or what IP seems to be getting the most traffic). Long-term though, you want to have some sort of netflow analyzer, or MRTG with "Adam's Uber MRTG Sorter". My UMS figures out the most recent 5-minute bits/second interval from the MRTG log for each target in the mrtg.cfg, and spits out a nice HTML table showing the top talkers on your network for the last 5 minutes. When you're graphing 100's of targets, it's very handy to find out what's going on at a glance. On Thu, 2004-02-26 at 09:32, Raymond Norton wrote: > I have a school experiencing network connectivity issues. So far it's a > mystery but looks like the network is being overwhelmed with traffic. I am > going to use ntop to look at things, but I am wondering if there is a > beater gui tool to see if the network is under high load, and if there may > be a defective switch or other device causing excessive collisions? > _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list