1

Is there a way to set up logging on a Cisco router to keep a log of all the host IP's and the ports successfully accessed the network and the last time port was accessed, and automatically garbage collects records from the log after a max time threshold is hit.

I would like to have such a log that I can access from a TCL program that can check what ports a host have been granted access to a host and whether they are still actively using that port.

This log would enable me to write a dynamic port granting api like port knocking or a similar scheme and reduce the number of brute force attacks that happen these days on edge routers

It is imperative that the solution be light weight so it can run on its own directly on a smaller scale SMB router like an 800 series.

Improve this question
2
  • 1
    You can log many things in a Cisco router, but what you are proposing will probably bring the router performance to its knees, and probably drive the CPU to an unacceptable load.
    – Ron Maupin ♦
    Commented Dec 15, 2015 at 16:33
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin ♦
    Commented Aug 12, 2017 at 23:41

1 Answer 1

Reset to default
1

This sounds like a job for NBAR and netflow.

NBAR collects protocol statistics:

rtr3745#show ip nbar protocol-discovery protocol http

 FastEthernet0/1 
                            Input                    Output                  
                            -----                    ------                  
   Protocol                 Packet Count             Packet Count            
                            Byte Count               Byte Count              
                            30sec Bit Rate (bps)     30sec Bit Rate (bps)    
                            30sec Max Bit Rate (bps) 30sec Max Bit Rate (bps)
   ------------------------ ------------------------ ------------------------
   http                     910077                   478364                  
                            1355496116               35911309                
                            0                        0                       
                            45313000                 1184000                 
   unknown                  2521171                  130821                  
                            2612681510               21335665                
                            1000                     0                       
                            18759000                 105000                  
   Total                    4661716                  1686610                 
                            4321983406               182285406               
                            2000                     4000                    
                            75164000                 1544000

Netflow can collect (and export) statistics on all traffic:

rtr3745#show ip cache flow 
...
IP Flow Switching Cache, 278544 bytes
  223 active, 3873 inactive, 301379 added
  182598876 ager polls, 0 flow alloc failures
  Active flows timeout in 60 minutes
  Inactive flows timeout in 600 seconds
...
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
TCP-Telnet         551      0.0         1    59      0.0       0.6     599.4
TCP-FTP             11      0.0         1    41      0.0       0.0     491.6
TCP-WWW          17048      0.0       149   972      4.2      52.1      52.5
TCP-SMTP            14      0.0         1    48      0.0       0.4     600.5
TCP-X              322      0.0         1    40      0.0       0.4     594.8
TCP-other        82581      0.1        27   404      3.8     216.4     118.1
UDP-DNS          88256      0.1         1    66      0.1       2.5     600.5
UDP-NTP           7639      0.0        10    75      0.1    1302.2     448.2
UDP-TFTP             6      0.0         1    56      0.0       0.0     600.3
UDP-other       100432      0.1         6   170      1.0     146.7     581.3
ICMP              1623      0.0         6    57      0.0     748.2     496.3
IPv6INIP           168      0.0      6964  1092      1.9    3557.4      22.1
 -IP-other           612      0.0       127   384      0.1    2912.6     170.9
Total:          299263      0.4        23   699     11.4     157.9     424.0

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Fa0/0         24.225.xxx.xxx  Fa0/1*        38.114.132.204  06 C261 006E    26 
Fa0/0         192.168.1.2     Fa0/1         173.194.205.104 06 8B3C 01BB    10 
...
Improve this answer
1
  • I tried using NBAR on an 892 once, but I had to remove it due to performance problems. The throughput dropped like a stone.
    – Ron Maupin ♦
    Commented Dec 15, 2015 at 21:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.