Sniffer Logs

[kr_madan]

Hi All,

When i sniff a serial T1 line using Sniffer Book.i see only frames..what could be the reason i see only frames ?

we use mgx to terminate the spans.

Actually i want to check for the source and destination ip address.

Thanks in advance

Madan

[jackyoung]

As I rememeber, there is a software come w/ the Sniffer can interpert the output log to read-able message.

Hope this helps.

[o.hassairi]

normally it s an option: capture all frame or just layer2 header.

any way you can use the net-flow feature to capture details about layer3/4.

router#configure terminal

router-2621(config)#interface serial0

router-2621(config-if)#ip route-cache flow

router-2621(config-if)#exit

router-2621(config)#ip flow-export destination 192.168.9.101 9996

router-2621(config)#ip flow-export source FastEthernet 0/1

router-2621(config)#ip flow-export version 5

router-2621(config)#ip flow-cache timeout active 1

then you should use some free software that can capture netflow packets like http://manageengine.adventnet.com/products/netflow/download.html

[kr_madan]

Hi Jackyoung,

Thanks for the reply.

I have checked the logs in the sniffer book software.

But in our case we enabled mux on the Multilink bundle.is this a reason that we are not able to see packet.

Thanks

Madan

[jackyoung]

What I think the issue is where do you probe the link, before the mux or after the mux. If before the mux, it should able to monitor the link.

I am sorry that I did not try it, so I can't help too much.

Did you check w/ the Sniffer provider, they should have more instruction in this case.

Hope this helps.