topic IPS 4255 - Network Sniffer? in Network Security

IPS 4255 - Network Sniffer?

davegon69 — Sun, 10 Mar 2019 10:27:59 GMT

one of my network engineers has asked if I can use our IPS device as a sniffer to identify specific host to host traffic via a specific port. I am somewhat new to IPS and am looking for some direction

Thanks,

Dave

Re: IPS 4255 - Network Sniffer?

s.jankowski — Fri, 16 Feb 2007 21:00:27 GMT

Yes, you can use an IPS for sniffing the packets. Refer the following URL for more information,

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a00807517b1.html

Re: IPS 4255 - Network Sniffer?

mhellman — Fri, 16 Feb 2007 21:21:40 GMT

Yes, but there are some limitations. Probably the best way to do this is via the CLI. Login with a normal account on the sensor (not a service account). Use the packet capture command:

sensor# packet capture gigabitEthernet0/0 expression

where is a tcpdump expression. So:

sensor# packet capture gigabitEthernet0/0 expression host 192.168.1.1 and port 80

To get the capture off the sensor, use the "copy packet-file" command. The biggest limitation is the size. I think it's something like 15MB, which isn't always big enough.