First you need a router (I assume you are talking about a
LAN-LAN routed link or LAN-WAN routed link or some other
such link) that supports SNMP. Some routers (cisco for
instance) have a link utilization object built into their
MIB. You can poll this periodically to get the result back.
If it goes above 80%, you do what you want.. However...
Finding out what machine is generating that traffic is LOTS
more complicated. You would almost need an RMON type MIB
built into the machine you are polling. You'd have to then
see if it has something like a 'top talkers' entry, and also
make sure that the information has been reset recently so
that you only get your 'recent' top talker, and not something
that is historical over a longer period of time. Getting
this adjusted correctly would be very tricky, assuming that
your router supports this sort of statistic, which most don't.
So the second half of your request is likely to be difficult.
You could just, upon receiving your alarm, go out and investigate
by hand with whatever tools you might have at your disposal
for traffic analysis.
-- ____________________________________________________________________________ Doug Hughes Engineering Network Services System/Net Admin Auburn University doug@eng.auburn.edu
-- !! This message is brought to you via the `tkined & scotty' mailing list. !! Please do not reply to this message to unsubscribe. To subscribe or !! unsubscribe, send a mail message to <tkined-request@ibr.cs.tu-bs.de>. !! See http://wwwsnmp.cs.utwente.nl/~schoenw/scotty/ for more information.