9

Is it possible to monitor a specific traffic type going through a cisco router? (like monitoring via wireshark)

Ex: I want to monitor http traffic specifically that is passing through a router. (or DNS, FTP, ...)

13

You could monitor the traffic

  • on the router, Cisco IOS 12.4(20)T and later, there is a packet capture feature, with filtering on interface name and direction and ACL.

    • set up an access list for matching the traffic
    • create a capture buffer monitor capture buffer holdpackets filter access-list <number>
    • define a capture point monitor capture point ... possibly with interface name, direction, and more - use the inline help to see possibilities
    • let the traffic pass
    • look at the capture buffer: show monitor capture buffer holdpackets dump, use export instead of dump to get a PCAP file for Wireshark analysis
    • don't forget to stop capturing, remove the capture point and delete the capture buffer afterwards

    For details and examples, follow the link or look at a Cisco troubleshooting manual.

  • on the switchport, where the router is connected to, for this you could set up a mirror port on the switch and monitor this via Wireshark

  • on the firewall, where the traffic passes

    Cisco ASAs are capable of remotely doing packet capturing and giving you the output as a PCAP file which you can open locally with Wireshark. The ASDM provides an assistant for this. Step by step, you can specify source and destionation interface, ACLs or src/dest networks/host, and the protocol you like to watch. That's why I like having ASAs in place everywhere - with a router CLI may seem a bit complicated.

Screenshot of the packet capture wizard

5

On the ISR G1/G2 routers you can use packet capture feature, where you use ACL to match the traffic and store it into memory during capture, then dump to .pcap compatible format if you need it offline:

https://supportforums.cisco.com/docs/DOC-5799

On the Catalyst 4500 with newer Supervisors you can actually run wireshark.

0

If Embedded Packet Capture is not available on your router you could try RITE: http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_rawip.html

3

The best methods (in my opinion) have already been mentioned, so simply incase you are on a device without those cool features, a fall back option is debug ip packet with an access list.

2

Netflow is another alternate method of monitoring traffic flows. It is better if you only want to know details at layers 3 and 4. The information can also be viewed locally on the router without the need for Wireshark.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.