I recently implemented Cisco NBAR at a remote sites, edge router. to filter and drop P2P traffic.

I see the dropped traffic by typing "show policy-map interface XXX"

how can i find the source of the torrent traffic ? specifically i'm looking for a way to log the source IP address.

1 Answer 1


Depending on which platform your using you can use NetFlow data to see this. Most Cisco routing platforms support this and even newer switching platforms support this as well.

Also simply logging the ACL (Adding log to the end of the ACL statement) will generate a log message that states the source of the packets that were denied.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.