Is it possible to monitor a specific traffic type going through a cisco router? (like monitoring via wireshark)
Ex: I want to monitor http traffic specifically that is passing through a router. (or DNS, FTP, ...)
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
You could monitor the traffic
on the router, Cisco IOS 12.4(20)T and later, there is a packet capture feature, with filtering on interface name and direction and ACL.
monitor capture buffer holdpackets filter access-list <number>
monitor capture point ...possibly with interface name, direction, and more - use the inline help to see possibilities
show monitor capture buffer holdpackets dump, use
dumpto get a PCAP file for Wireshark analysis
For details and examples, follow the link or look at a Cisco troubleshooting manual.
on the switchport, where the router is connected to, for this you could set up a mirror port on the switch and monitor this via Wireshark
on the firewall, where the traffic passes
Cisco ASAs are capable of remotely doing packet capturing and giving you the output as a PCAP file which you can open locally with Wireshark. The ASDM provides an assistant for this. Step by step, you can specify source and destionation interface, ACLs or src/dest networks/host, and the protocol you like to watch. That's why I like having ASAs in place everywhere - with a router CLI may seem a bit complicated.
On the ISR G1/G2 routers you can use packet capture feature, where you use ACL to match the traffic and store it into memory during capture, then dump to .pcap compatible format if you need it offline:
On the Catalyst 4500 with newer Supervisors you can actually run wireshark.
The best methods (in my opinion) have already been mentioned, so simply incase you are on a device without those cool features, a fall back option is
debug ip packet with an access list.
Netflow is another alternate method of monitoring traffic flows. It is better if you only want to know details at layers 3 and 4. The information can also be viewed locally on the router without the need for Wireshark.
If Embedded Packet Capture is not available on your router you could try RITE: http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_rawip.html