Port mirroring on WAN for Cisco 851W

[Daniel Perez]

I have looked up the command sequence for port mirroring and it seems pretty straight forward however in my case the command will not execute.

I have a 851W with 12.4T

If I do:

#monitor session 1 source interface fa 4      (wan port)

i get the response invalid input detected however if I do the same command for fa 1, fa ,2 and fa 3 they work

Using the ? help shows the valid entries are [0-4] for fastethernet

Is the help dialogue wrong here or have I missed something?

I just want to monitor WAN traffic with WireShark, particularly DDNS requestes, with a spare PC connected to a free lan port.

I would use a hub on the Wan connection but unfortunately I do not have one at the moment.

Thanks

[cadet alain]

Hi daniel,

I Think the WAN port is a router port and so it doesn't support SPAN but you can use either one of these 2:

1) RITE

http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_rawip.html

2) EPC

http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_packet_capture_ps6441_TSD_Products_Configuration_Guide_Chapter.html

Regards.

Alain.

[Daniel Perez]

Thank you!

Very nice solutions. I have a little reading to do but I think the included examples will help me just fine.

[Daniel Perez]

While your answer may be correct are you certain I can utilize these options on a 851?

There are no commands like 'monitor capture buffer' or 'ip traffic-export' that I can see in ? Help

Is it possible these features are only available on higher-end devices. The IP traffic export manual says that only 1841 , 2800 and 3800 series are supported so I then kept my fingers crossed to see if embedded capture was an option but the command set is not there either. I did not see any dialogue saying the 800 series was excluded from the embedded capture PDF.

Do I need a newer IOS? I am at 12.4T (experimental)

It woul be really disappointing to find out this device lacks such simple fetures. I have seen cheapo Best-Buy routers with some mirroring capabilty.

Thanks again.

[cadet alain · Accepted solution]

Hi for rite this is supported on your platform but you need at least this IOS:

c850-advsecurityk9-mz.124-2.T

Regards.

Alain.

[Daniel Perez]

This is what shows up un mine:

Cisco IOS Software, C850 Software (C850-ADVSECURITYK9-M), Experimental  Version 12.4(20080529:203115) [ppergame-sq51158 102]

Is that still too early a rev? I am not sure what the number in the parenthesis mean.

Thanks for your help

[cadet alain]

Hi,

I'm sorry but this is the first time I see this IOS version but indeed it seems it's not a good one for RITE.

Regards.

Alain.

[Daniel Perez]

Scratch my last reply I loaded a newer rev and I think I have enabled some new command sets. I will get back to you if it does not work.

Thanks

[Daniel Perez]

I tried to use IOS 12.4(15) to see if I would get 'IP Traffic Export Packet' features and I got zero. I looked further into it with the Cisco Feature Navigator and surprise, the features has been removed from the IOS on newer revisions. Seems a little silly to remove a nice feature like that huh?

At this point it may be easier for me to use a cheap $10 hub on my WAN link.

Thanks