1

Is there any way to somehow log all incoming messages for Network devices, like who pinged my switch or who is trying to connect to my switch and what protocol was used?

Is it possible to do it with syslog? And has anyone tried it in a lab or real net?

Thanks in advance.

  • Can you clarify what type of message you want to log? Logging connection attempt to the management interface is easy (it is done by default on some equipment), logging all incoming traffic is somewhat different. Also we need to know the device brand, model and software version. This really depends on the device capabilities – JFL Jan 26 '18 at 11:13
  • Hi, I'm talking about all kind of incoming messages, Any request which coming from the outside of my network to my switch/router. As I know on CISCO devices you can specify ACL with filtering of traffic and log everything in buffer and than send it to syslog server. But, this solution is increasing CPU of device. So, I want to do the same but without ACL-s on each interface to track the traffic in case if someone is trying something to do from outside. for example track ICMP requests: for example : 'IP-SRC: 10.10.10.124 send ICMP to IP-DST: 10.10.10.1 - ICMP Reply. – Itamar Zimmerman Jan 26 '18 at 12:34
  • It really sound like you want to use NetFlow. – Ron Maupin Jan 26 '18 at 14:52
1

As an example if you want to log ICMP (ping) on your switch then you can send the log directly to the local buffered log on the switch and you can setup a syslog destination to receive the log from the switch.

First of an access-list and this is all based on Cisco.

ip access-list extended test
 permit icmp any any log-input
 permit ip any any

Add the access list to an interface. I will add it to a local test interface Vlan 1.

interface Vlan1
 description SW_MGMT
 ip address 192.168.1.2 255.255.255.0
 ip access-group test in

Now when i ping the device on my test network, the switch will log:

Jan 26 15:09:55.310: %SEC-6-IPACCESSLOGDP: list test permitted icmp 192.168.1.22 (Vlan1 107b.4459.5c6e) -> 192.168.1.2 (
0/0), 8 packets

If you want to setup logging for your switch, assuming you have a syslog server of some sort, you can use this configuration on the switch:

logging origin-id hostname 

I like when i can see the device name as typically my devices have unique names.

logging 192.168.1.250 

The Syslog server IP

logging trap notifications 

What level you should send to your syslog server

logging history notifications 

This is the switch local log and SNMP setting for logging level

logging buffered 96000 

Local switch log buffer in bytes.

  • Thanks a lot Cown, this is a great example which i wanted, now I'll test it on my lab..:) – Itamar Zimmerman Jan 28 '18 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.