cisco traffic monitoring

I have been playing with my cisco router for as long as I've had them.

I haven't found a good way to monitor traffic though. Sure, I can put a sniffer before/after the router... but I wanted to do it through the router. Is that possible?

I know I can show nat translations...

sh ip nat tran

But can I show the traffic/protocols in realtime?

I'm just using a cisco router, not a PIX.

On PIX, they have a show connections command... which is basically what the sh ip nat tran command does.. but I'm looking for something more informative.

Start Syslog, set up an off-router repository for the logs. Easy as pie.

-edit: Dammit, I should have asked the obvious question. What model router and what IOS version are you running. I just noticed under your name it says you got an 831. I don't know if the SOHO routers support logging.

I do have logging going to a syslog server. I'm running IOS 12.3.8T (I know there are updates...)... So, basically log everything? That won't give me packet dumps or anything, just connections/ports... I suppose I could do that...

Right now I'm only logging firewall denied... not permitted.

I suppose I'm asking too much from it. If it had to sniff/log all traffic... I'd probably be at the speeds of dial up when I'm done.

I might just put the sniffer back on the inside of the router...

HT has a good solution:

Quote:

---

One good way to do a packet dump on a Cisco is:

router(config)#access-list 199 permit ip

router(config)#access-list 199 permit ip

router(config)#end
router# debug ip packet 199 dump

E.g.

access-list 199 permit ip host 192.168.0.1 any
access-list 199 permit ip any host 192.168.0.1

Will dump packets destined to and from 192.168.0.1.

---

Thats one smart focker right there.

It's very dirty but can you run your traffic through a Linux box running IPTRAF?

Your PIX can graph some things if you use the Java web tool (if supports)

LINK:
http://cebu.mozcom.com/riker/iptraf/

I thought about putting another box in front of it... like you say. There are tons of tools I could use then... but I was hoping to get it all done with just what is there...

I wish I had a pix though... maybe I can talk the GF into getting me one next year for my bday. :)

I'll just have to talk it up big. She couldn't understand why I needed a 831 when I already had a 806... lol... women...

I have it logging to a syslog server and I'm also using MRTG.
That can graph traffic... that works pretty good.

Might as well as just put it all on one box...

I'm an assface and didn't properly read.

I read you were using a PIX also.

Sorry for my dumbness!!



:D

No reason to be sorry. Thanks for your suggestion/input. :)

Quote:

---

Originally posted here by phishphreek80
No reason to be sorry. Thanks for your suggestion/input. :)

---

My wife says I have ADD.

Wait, what was I going to say..??

Since you already use MRTG, you can do a combo...

This link may be helpful..

http://www.taedium.com/rrd-iptraf/

Nice link. I'll look into it.

Thanks!

Since you're around... If you wouldn't mind... check out another thread I started just now dealing with SNMP and MRTG.

http://www.antionline.com/showthread...172#post782172

Solar winds ?! engineers edition. has all the mibs you would need to monitor your router. There is a linux version with the mibs also, cannot remember what it is name is unfortunately. be warned though, you going to need icmp and snmp enabled, even if is only for the box that will be doing the monitoring. if that box was compromised tough .... this app or cisco works <---- overkill perhaps if for home use?!