<img src="//bat.bing.com/action/0?ti=5794969&amp;Ver=2" height="0" width="0" style="display:none; visibility: hidden;">

Tracking Down and Restricting High-Bandwidth Hosts on a Cisco Network

[fa icon="long-arrow-left"] Back to all posts

[fa icon="pencil'] Posted by Dave Lincoln [fa icon="calendar"] August 10, 2015

Assume that you have a branch office reporting connectivity issues/slowness but your organization does not have realtime monitoring tools (such as SolarWinds NetFlow Analyzer) which can help you quickly narrow down the culprit. We will discuss how to identify which hosts are moving the most traffic and go over how (if desired) to locate a host on your network and disable or limit its connection.

First, to determine which hosts are consuming the largest amount of bandwidth on a connection, we will want to use IP accounting.

  1. On the outbound interface of the branch’s router or firewall:
Router1(config)# interface Gi0/1
Router1(config-if)# ip accounting output-packets
  1. After allowing some time to gather statistics (5 minutes should suffice), view what has been captured:
Router1# show ip accounting
Source          Destination     Packets    Bytes   2          80    27         2782   28         2822  13         7053   1996       1239889 2          80    4          848

As we can see in this example, the traffic between and is generating the highest utilization of the link. Now we will track down and disable or limit its network connection.

  1. We first need to determine the MAC address of This needs to be done from the gateway device for the host’s subnet ( /24):
Router2# show arp | include
Internet   0    7071.bcab.7091  ARPA Vlan3
  1. Next we need to determine from which interface the MAC address was learned:
Router2# show mac address-table address 7071.bcab.7091
Mac Address Table
Vlan   Mac Address       Type       Ports
----   -----------       --------   -----
   3   7071.bcab.7091   DYNAMIC     Gi0/2
Total Mac Addresses for this criterion: 1
  1. Determine what the neighbor device is and then connect to it:
Router2# show cdp neighbors Gi0/2 detail
Device ID: Switch1.example.com
Entry address(es):
IP address:
------output omitted-----
  1. From the neighbor device (in this case, Switch1), we perform Step 4. If necessary, we will also perform Step 5. We will repeat both of these steps until we have located the switch access port to which the host is connected.
  2. Once the host’s port is located, we can simply shut down the port or we can instead limit the port speed:
Switch3# interface Gi0/23
Switch3(config-if)# shutdown
Switch3# interface Gi0/23
Switch3(config-if)# bandwidth 5000

Please keep in mind any changes that were made in order to undo them once better mitigation is put in place (such as QoS and/or policing).

Topics: Cisco, Networking

Dave Lincoln
Written by Dave Lincoln

  • View & Submit Comments

[fa icon="envelope"] Subscribe to Email Updates

[fa icon="comments-o"] Follow us

Get even more great content, photos, event info and industry news.

[fa icon="calendar"] Recent Posts