cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
488
Views
0
Helpful
4
Replies

how do you find which ip address is kicking off the dials

f.fnlaspect
Level 1
Level 1

Can anyone tell me how to find out what ip address has initiated the dials for async calls in the following config, you cant simply do a 'sh isdn act'I have run deb on isdn eve/q931/q921 but this just shows which pri is being used and not which ip address is causing it:-

Using 8229 out of 129016 bytes

!

version 12.1

no service single-slot-reload-enable

service timestamps debug datetime msec

service timestamps log datetime localtime

service password-encryption

!

hostname STO_RPN

!

boot system flash c3660-i-mz.121-5.T12.bin

logging buffered 4096 debugging

logging rate-limit console 10 except errors

aaa new-model

aaa authentication login default none

aaa authentication login user group tacacs+

aaa authentication login console group tacacs+ local

aaa authentication ppp user group tacacs+

aaa authorization exec default group tacacs+

aaa authorization exec unix none

aaa authorization commands 15 default group tacacs+ if-authenticated

aaa accounting exec default start-stop group tacacs+

aaa accounting network default start-stop group tacacs+

enable secret

!

username xxxx password xxx

username xxxxxx password xxxx

username xxxx password xxxx

username xxxx password xxxx

modem country mica united-kingdom

ip subnet-zero

!

!

no ip finger

ip name-server 194.35.160.11

!

async-bootp dns-server 194.35.160.11 126.0.10.61

async-bootp nbns-server 169.136.140.56 169.136.140.61

isdn switch-type primary-net5

chat-script callback ABORT ERROR ABORT BUSY "" "ATDT\T" TIMEOUT 30 "CONNECT" \c

chat-script offhook "" "ATH1" OK

!

!

controller E1 1/0

framing NO-CRC4

pri-group timeslots 1-30

!

controller E1 1/1

shutdown

framing NO-CRC4

pri-group timeslots 1-30

!

controller E1 2/0

framing NO-CRC4

pri-group timeslots 1-30

!

controller E1 2/1

framing NO-CRC4

pri-group timeslots 1-30

!

!

interface FastEthernet0/0

ip address 169.136.139.20 255.255.255.0

ip access-group 155 in

ip access-group 101 out

ip accounting output-packets

ip nat inside

speed auto

full-duplex

no cdp enable

!

interface FastEthernet1/0

no ip address

shutdown

duplex auto

speed auto

no cdp enable

!

interface Serial1/0:15

no ip address

encapsulation ppp

dialer pool-member 1

isdn switch-type primary-net5

isdn incoming-voice modem

isdn send-alerting

no peer default ip address

no cdp enable

ppp authentication pap chap callin user

ppp multilink

!

interface Serial1/1:15

no ip address

encapsulation ppp

dialer pool-member 1

isdn switch-type primary-net5

isdn incoming-voice modem

isdn send-alerting

no peer default ip address

no cdp enable

ppp authentication pap chap callin user

ppp multilink

!

interface Serial2/0:15

no ip address

encapsulation ppp

dialer pool-member 1

isdn switch-type primary-net5

isdn incoming-voice modem

isdn send-alerting

no peer default ip address

no cdp enable

ppp authentication pap chap callin user

ppp multilink

!

interface Serial2/1:15

no ip address

encapsulation ppp

dialer pool-member 1

isdn switch-type primary-net5

isdn incoming-voice modem

isdn send-alerting

no peer default ip address

no cdp enable

ppp authentication pap chap callin user

ppp multilink

!

interface Group-Async1

ip unnumbered FastEthernet0/0

ip access-group 102 in

ip helper-address 169.136.140.211

ip helper-address 169.136.140.56

encapsulation ppp

ip tcp header-compression passive

no ip mroute-cache

dialer in-band

dialer idle-timeout 600

dialer wait-for-carrier-time 20

dialer-group 1

async dynamic routing

async mode interactive

peer default ip address pool pool1

no ppp lcp fast-start

ppp callback accept

ppp authentication pap chap callin user

group-range 97 222

!

interface Dialer1

ip unnumbered FastEthernet0/0

ip access-group 104 in

ip helper-address 169.136.140.56

ip helper-address 169.136.140.211

encapsulation ppp

ip tcp header-compression passive

dialer pool 1

dialer remote-name one

dialer idle-timeout 600

dialer string

dialer-group 1

peer default ip address 1.1.1.2

no cdp enable

ppp authentication pap chap callin user

ppp multilink

!

interface Dialer2

description Connection to MCI

ip address 170.127.85.211 255.255.255.192

ip access-group 106 in

ip nat outside

encapsulation ppp

dialer pool 1

dialer remote-name ext-lon14-gw2

dialer idle-timeout 60

dialer string

dialer-group 2

no cdp enable

ppp authentication chap user

ppp multilink

!

ip local pool pool1 169.136.139.141 169.136.139.153

ip nat inside source list 103 interface Dialer2 overload

ip nat inside source static tcp 194.35.160.7 23 interface Dialer2 23

ip nat inside source static udp 194.35.160.7 6502 interface Dialer2 6502

ip nat inside source static tcp 194.35.160.7 21 interface Dialer2 21

ip nat inside source static tcp 194.35.160.7 20 interface Dialer2 20

ip nat outside source static 166.59.131.181 172.16.175.21

ip classless

ip route 0.0.0.0 0.0.0.0 169.136.139.9

ip route 1.1.1.2 255.255.255.255 Dialer1

ip route 166.59.131.181 255.255.255.255 Dialer2

ip route 170.127.204.0 255.255.255.0 Dialer2

ip route 172.16.175.21 255.255.255.255 Dialer2

no ip http server

!

access-list 101 permit tcp any eq 7001 any

access-list 101 permit tcp any any eq 7001

access-list 101 permit tcp any any eq ftp

access-list 101 permit tcp any any eq ftp-data

access-list 101 permit tcp any eq ftp-data any

access-list 101 permit tcp any eq ftp any

access-list 101 permit udp any any eq netbios-ns

access-list 101 permit tcp any any eq telnet

access-list 101 permit tcp any eq telnet any

access-list 101 permit udp any any eq 6502

access-list 101 permit udp any eq 6502 any

access-list 101 permit icmp any any

access-list 102 permit tcp any host 194.35.160.7 eq ftp

access-list 102 permit tcp any host 194.35.160.7 eq ftp-data

access-list 102 permit tcp any eq ftp-data host 194.35.160.7

access-list 102 permit tcp any eq ftp host 194.35.160.7

access-list 102 permit tcp any host 194.35.160.7 eq telnet

access-list 102 permit tcp any eq telnet host 194.35.160.7

access-list 102 permit udp any host 194.35.160.7 eq 6502

access-list 102 permit udp any eq 6502 host 194.35.160.7

access-list 102 permit icmp any host 194.35.160.7

access-list 103 permit ip 169.0.0.0 0.255.255.255 any

access-list 103 permit ip 172.16.0.0 0.0.255.255 any

access-list 103 permit ip 194.0.0.0 0.255.255.255 any

access-list 104 permit tcp host 169.136.139.20 any eq telnet

access-list 104 permit tcp any host 169.136.139.20 eq telnet

access-list 104 permit icmp any any

access-list 106 permit tcp any any eq ftp

access-list 106 permit tcp any any eq ftp-data

access-list 106 permit tcp any eq ftp-data any

access-list 106 permit tcp any eq ftp any

access-list 106 permit tcp any any eq telnet

access-list 106 permit tcp any eq telnet any

access-list 106 permit udp any any eq 6502

access-list 106 permit udp any eq 6502 any

access-list 106 permit icmp any any

access-list 115 deny tcp any any eq 135 log

access-list 115 permit ip any any

dialer-list 1 protocol ip permit

dialer-list 2 protocol ip list 102

no cdp run

tacacs-server host 169.136.139.55

tacacs-server key

snmp-server community xxxx

snmp-server community xxxxx

snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart

snmp-server enable traps config

snmp-server host 169.136.141.203 n00n3

!

line con 0

transport input none

line 97 126

autoselect ppp

script modem-off-hook offhook

script callback callback

authorization exec unix

refuse-message ^CCCC [!NMM!] No Modems Available ^C

modem answer-timeout 180

modem InOut

modem autoconfigure type mica

rotary 1

autocommand telnet 194.35.160.7

transport preferred telnet

transport input all

flowcontrol hardware

line 129 158

autoselect ppp

script modem-off-hook offhook

script callback callback

authorization exec unix

refuse-message ^CCCC [!NMM!] No Modems Available ^C

modem answer-timeout 180

modem InOut

modem autoconfigure type mica

rotary 1

autocommand telnet 194.35.160.7

transport preferred telnet

transport input all

flowcontrol hardware

line 193 222

autoselect ppp

script modem-off-hook offhook

script callback callback

authorization exec unix

refuse-message ^CCCC [!NMM!] No Modems Available ^C

modem answer-timeout 180

modem InOut

modem autoconfigure type mica

rotary 1

autocommand telnet 194.35.160.7

transport preferred telnet

transport input all

flowcontrol hardware

line aux 0

line vty 0 4

exec-timeout 0 0

password xxx

login authentication console

!

end

Thanks, Lee.

4 Replies 4

liviu.gheorghe
Spotlight
Spotlight

The command you are looking for is "debug dialer". It will tell you the source IP address which triggered the dial and also the destination IP address.

Cheers

Regards, LG
*** Please Rate All Helpful Responses ***

Thanks for your reply.

However, this doesnt show any IP addresses. I have listed the results from the debug dialler below:-

*Mar 17 08:04:52: %ISDN-6-DISCONNECT: Interface Serial1/0:0 disconnected from u

nknown , call lasted 237 seconds

*Mar 17 08:05:57: %ISDN-6-CONNECT: Interface Serial1/0:0 is now connected to N/A

N/A

*Mar 17 08:06:56: %ISDN-6-CONNECT: Interface Serial1/0:1 is now connected to N/A

N/A

*Mar 17 08:07:14.206: As195 DDR: Dialer received incoming call from

*Mar 17 08:07:16: %LINK-3-UPDOWN: Interface Async195, changed state to up

*Mar 17 08:07:16.206: As195 DDR: Dialer statechange to up

*Mar 17 08:07:16.206: As195 DDR: Dialer received incoming call from

*Mar 17 08:07:21.898: As195 DDR: Authenticated host ASPECT_NT \1699 with no matc

hing dialer map

*Mar 17 08:07:22.346: As195 DDR: dialer protocol up

*Mar 17 08:07:22: %LINEPROTO-5-UPDOWN: Line protocol on Interface Async195, chan

ged state to up

*Mar 17 08:07:32: %ISDN-6-DISCONNECT: Interface Serial1/0:1 disconnected from u

nknown , call lasted 35 seconds

*Mar 17 08:07:35: %LINK-5-CHANGED: Interface Async195, changed state to reset

*Mar 17 08:07:36: %LINEPROTO-5-UPDOWN: Line protocol on Interface Async195, chan

ged state to down

*Mar 17 08:07:40: %LINK-3-UPDOWN: Interface Async195, changed state to down

*Mar 17 08:07:50.330: As195 DDR: re-enable timeout

*Mar 17 08:08:57: %ISDN-6-DISCONNECT: Interface Serial1/0:0 disconnected from u

nknown , call lasted 179 seconds

Any ideas?

Debug dialer events needs to be run on the router that is initiating the call, here the above router is receiving the call.

*Mar 17 08:07:14.206: As195 DDR: Dialer received incoming call from

http://cisco.com/en/US/products/sw/iosswrel/ps1831/products_command_reference_chapter09186a00800eea59.html#1019376

Thanks, Mak.

Thanks for your reply.

Trouble is, due the natting I cant see what machine is causing each dial. Basically, what is happening is that some users on our network are using the dial-out facility to call Thailand for long periods of time and I have been asked to find out who. The users are using dialoutEZ (which replaced Cisco dialout client) to use a virtual modem in their dial-up networking. This then points to the fa0/0 of the above. Please help!

Review Cisco Networking for a $25 gift card