SRX

A few options, as I see it:

1.  Use jflow (requires an external collector, or does it?*)

2.  Use "show security flow session" and look for the highest byte/packet count (not really easy to use with a decent number of flows)

3.  Use "port mirroring" or analyzer session and send data to a sniffer for top talker analysis.

Any other ways?

* Is there any way to view jflow data locally without using an external collector?  Similar to Cisco's "show ip cache flow" for netflow?  I see 'set forwarding-options sampling family inet output file' option, but that never gets populated with data.

Use JFlow and an external collector... It is easy to see a trend sampled over time.

Scrutinizer

http://www.plixer.com/products/netflow-sflow/free-netflow-scrutinizer.php

Scrutinizer is nice, you can use it for free but it only holds 24hrs of data when in free mode, however this is almost always enough for me at least sice bandwidth hogs show up nice and clear in the reports....

Thanks.  Yep, I'm aware of Jflow with an external collector.  

But I was really hoping for a quick way "on the SRX" without requiring an external application.  

Like with Cisco's Netflow implementation....  Sure, you can export it to a netflow collector.  But you can also just use it locally with the "show ip cache flow" command.  So without installing any type of collector, you can quickly see who is hogging all of the bandwidth.

I was hoping I could use jflow with a local file.  But that doesn't seem to work.  

This might help

http://www.juniper.net/techpubs/en_US/junos10.2/topics/reference/command-summary/show-services-subscriber-bandwidth.html

I still think setting up a collector is a far better way, since this is often a repeat problem, and sometimes you receive reports of "its slow" after the fact and it is easy to go back a few hours or min and look at the collector to see who was the problem or see a trend if you have peek hours problems.

Dear SomITGuy

Did you find any solution for this issue? Could you please share it with me

Best Regards

Alcidio Tembe

---

@SomeITGuy wrote:

This might help

http://www.juniper.net/techpubs/en_US/junos10.2/topics/reference/command-summary/show-services-subscriber-bandwidth.html

 

I still think setting up a collector is a far better way, since this is often a repeat problem, and sometimes you receive reports of "its slow" after the fact and it is easy to go back a few hours or min and look at the collector to see who was the problem or see a trend if you have peek hours problems.

---

---

@SomeITGuy wrote:

This might help

http://www.juniper.net/techpubs/en_US/junos10.2/topics/reference/command-summary/show-services-subscriber-bandwidth.html

 

I still think setting up a collector is a far better way, since this is often a repeat problem, and sometimes you receive reports of "its slow" after the fact and it is easy to go back a few hours or min and look at the collector to see who was the problem or see a trend if you have peek hours problems.

---