topic Traffic Analysis - ASA in Network Security

Traffic Analysis - ASA

omer_babiker — Mon, 11 Mar 2019 23:17:30 GMT

Hi all,

If I noticed a lot of (incoming&outcoming) traffic in outside interface of ASA. Is there any way to know where is this traffic coming or going to (IP address)?

And if that traffic happened earlier (for example 1 day ago), can I still know the origin or destination IP address?

Please help!!

Thanks in Advance,

Omer

Traffic Analysis - ASA

Marvin Rhoads — Sun, 10 Jun 2012 13:27:26 GMT

There's no easy way to tell if you didn't already have instrumentation turned on.

The ASA is capable of exporting netflow data to an external collector. It is there that you would be able to retrospectively analyze top flows by source and destination address and port. Additionally in near real time you can monitor the top 10 hosts in the ASDM dashboard (or CLI equivalent).

Traffic Analysis - ASA

omer_babiker — Mon, 11 Jun 2012 05:16:26 GMT

Thanks Marvin for your reply.

Actually I asked this question because I've seen spiky load in my outside interface which looked suspicious. I was curious to know where it came from.

I used show conn command, but it was only showing the connections in use.

I'm using opennms as monitioring tool, but not sure if it will help in this case.

Any recommendation??

Thanks,

Omer

Traffic Analysis - ASA

Marvin Rhoads — Mon, 11 Jun 2012 14:23:26 GMT

The open source tool for capturing and analyzing netflow exports is ntop. Please see more information at http://www.ntop.org/products/ntop/

Traffic Analysis - ASA

omer_babiker — Tue, 12 Jun 2012 05:04:56 GMT

Thanks for the valuable information