Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I recently implemented Cisco NBAR at a remote sites, edge router. to filter and drop P2P traffic.
I see the dropped traffic by typing "show policy-map interface XXX"
how can i find the source of the torrent traffic ? specifically i'm looking for a way to log the source IP address.
Depending on which platform your using you can use NetFlow data to see this. Most Cisco routing platforms support this and even newer switching platforms support this as well.
Also simply logging the ACL (Adding log to the end of the ACL statement) will generate a log message that states the source of the packets that were denied.
