Scan traffic to a public IP

[hilmarinex]

Hi,

Im having problems with google saying we generate to much traffic to www.google.com.

http://sorry.google.com/sorry/?continue=http://www.google.com/search%3Faq%3Df%26sourceid%3Dchrome%26ie%3DUTF-8%26q%3Ddfl

I need to know which machines on the inside are talking so much with google. Can this be done via ASA 5510? do i need a third party program for this?

/Hilmar                  

[Jouni Forss]

Hi,

I'm not sure how many different IP addresses/subnets are involved with Google but if you can create a group of IP addresses/networks then you could

• Create ACL rule and log hits to the rule in questions to your syslog server and monitor which hosts are connecting to the said IP addresses
• Create a simple traffic capture on the ASA for the said destination IP addresses and look/parse through the capture file with Wireshark for example

Those are the first two that came to mind.

- Jouni