Detect high bandwith consumption

[procom]

Hello everyone!

I´m looking for a way to identify a user or IP when they have high bw consumption

Lets say a user is downloading something and is using all my ISP bw, how can I identify it in that moment?

I was able to do this but when the session was finished, in my scenario my user downloaded something for 2hs an I had to wait until that to identify, this is very frustrating.

Has anyone find a way to do this? it will be very very helpful

Thanks in advance!

[YEmreSeven]

You can identify from ACC tab. Also you can use QoS policy to limit user's bandwidth or identify user.

[procom]

Hello  YEmereSeven,

Sadly ACC refresh every 15 minutes and if the session is still going it will not show until it ends.
QoS you can see real time traffic (with the graph) but can`t identify the user that is consuming at that time.

It is really disappointing and wierd that PA has no way to do this.

Regards!

[zGomez]

Hi Procom,

You can try identify the sessions from the CLI that is above a certain amount of data.

show session all filter min-kb 1048576 ( will give you all session above 1 GB)

Take into account this will also include long running sessions.

But should give you a good indication.

You could also try using netflow.

For session that have already ended you can use the ACC dashboard.

I have asked ChatGPT for some python code that can help you print out the session that go above a certain througput.

10 Mbps in the example you can adjust the params to what you want.

Bandwidth Hogs - Pastebin.com

[YEmreSeven]

Hi Procom, QoS without using the bandwidth limitation will show you to live traffic. But it will be show only offloaded traffic. We can't see the real throughput from SNMP or QoS.