IOS monitoring packets

[albertobrivio]

Hi ARSHAD,

Posted by: albertobrivio - May 19, 2006, 8:11am PST

I'd like to know if does in IOS environment exist command like "show conn" or "capture" normally available in PIX firewall, in order to take a look at the packet source/destination address/port crossing interface.

Regards

Alberto Brivio

[arshad · Accepted solution]

Alberto,

If you're asking in IOS firewall context then you can get the outputs like

show ip inspect session detail (Provided you have IOS firewall configured and applied on interface).

If you want to monitor all the packets going in out from the interface you need to check the "netflow" technology .

Enable "ip flow ingress" on the specific interface and then do "show ip cache flow" you'll be able to see the traffic flow.

If you're interested in some functionality like "tcpdump" like sniffer capability in IOS let me know as well.

Thanks and Regards

Arshad

[albertobrivio]

Hi ARSHAD,

thanks for your reply, it has been very useful.

Anyway,if you're other suggestions / tips about functionality you was talking to (like "tcpdump" and sniffer capability in IOS) I'll be very gratefully.

Regards

Alberto Brivio

[Fernando_Meza]

Adding a bit more I suggest you using Netflow analyser. you can download a 30 days trial version from the below link. The only thing you need is to configure the routers with netflow and the system where netflow analyzer is installed will do the rest. After the 30 days expired you can still use the application for 2 interfaces ONLY which is great if you only need to monitored on entry point ..i.e Internet router.

http://manageengine.adventnet.com/products/netflow/index.html

http://manageengine.adventnet.com/products/netflow/help.html

i hope it helps ... please rate it if it does !!!