topic Re: How to check which ip's are hitting on a particular interfac in Network Security

How to check which ip's are hitting on a particular interface of ASA 5520

prashantrecon — Mon, 11 Mar 2019 23:57:58 GMT

Hi ,

I have a cisco asa 5520 and suddendley in my Network Monitor tool,(using SNMP) asa's DMZ interface traffic is showing arround 90000 Kbit/s .

i want to check which traffic is flowing throgh this interface.(Ip address details)

Note : There is no impact on asa CPU usage.

Regards,

Prashant

Re: How to check which ip's are hitting on a particular interfac

Jouni Forss — Mon, 24 Sep 2012 09:43:10 GMT

Hi,

I guess there is several things you can check on your firewall.

Check the active connection on the ASA
- show conn | inc

Check the hosts that have connections through the ASA on that interface
- show local-host | begin Interface

Generate log messages to a syslog server from each connection formed
- Either using "logging trap informational"
- OR check what the Syslog ID for connection Building/Teardown is and change its logging level to your current one
- OR configure logging parameters to the access-list/ACE statements to generate logging messages on certain syslog/logging level

Configure traffic capture on the interface and simply capture all the traffic on the firewall interface in question
- The maximum buffer size for the capture is around 33,5MB but it can be set to overwrite the previous data
- You also dont have to capture the complete packet
- After the capture (or during it) you can copy the capture file to your computer and open it with Wireshark to see whats connections are being taken through the interface in question.

Those are just some things that came to mind. I'm sure theres probably other ways to go about this thing also.

- Jouni

Re: How to check which ip's are hitting on a particular interfac

prashantrecon — Mon, 24 Sep 2012 10:15:28 GMT

Thanks it is very helpful

Re: How to check which ip's are hitting on a particular interfac

Suresh Babu — Mon, 24 Sep 2012 10:59:17 GMT

Hi All,

How do i check the same connection logs in ASDM GUI mode.

Please help...

Rgds

Re: How to check which ip's are hitting on a particular interfac

prashantrecon — Tue, 25 Sep 2012 03:47:13 GMT

Hi Jouni,

When i am checking the traffic in ASDM graph it is only showing me between 20 - 50 Kbps (and it is normal) at the same time on SNMP sensor dmz traffic is around 90,371 kbit/s.

so i think actual traffic is the ASDM graph traffic .