Skip to main content
6 votes
Accepted

Valid use cases for packet deduplication?

Usually this is discussed in the context of network capture appliances. So - for example - if you have taps on four links and a given packet happens to traverse all four then you'll naturally see ...
rnxrx's user avatar
  • 6,124
4 votes

SNMP Monitoring Juniper EX8216 switches for Rx/Tx power, temperature and bias current

Unfortunately the DOM MIB does not seem to be supported on any of the EX 22/32/42/82xx switches. I've been bitten by this in the past. The values are present on the device eg: show interfaces ...
Benjamin Dale's user avatar
4 votes

How do behave the AP during monitoring mode?

Monitor Mode provides constant channel scanning with attack detection and forensics (packet capture) capabilities. Capture packets regardless of connected network. No association to AP needed (and no ...
Datagram.Network's user avatar
4 votes
Accepted

Netflow on all interfaces?

When you only have one Router, then you are fine monitoring both directions or both interfaces. If you monitor both directions and both interfaces, you will be monitoring duplicated flows. The ...
Eddie's user avatar
  • 15.1k
4 votes

Sampled Netflow

Typically, the approach is indeed just "multiply the observed octet/packet sample counts by 100" (or 1000, or whatever) and that does pretty well for getting overall traffic volumes roughly correct. ...
John Murphy's user avatar
4 votes
Accepted

Is letting routers generate traps on bgp changes a bad idea

The concern is that generating the traps will affect the performance of the router, especially on that day when things go wrong and you have a lot of changes. Some problem will cause instability, ...
Ron Trunk's user avatar
  • 67.7k
4 votes
Accepted

Send command lines to syslog server

You can send configuration commands to the syslog server with the notify syslog command (Cisco IOS Configuration Fundamentals Command Reference): archive ! archive configuration mode log ...
Ron Maupin's user avatar
  • 99.9k
4 votes
Accepted

Finding the available capacity on switch interface in bytes or bits

I believe what you're really needing to know is whether the interface is being used "optimally" and how much "spare capacity" you have on that link. These are fuzzy terms, but important because you ...
mere3ortal's user avatar
  • 2,416
4 votes
Accepted

How can I monitor traffic matching a IP address?

Add the host keyword. As in: user@host> monitor traffic matching "host 192.0.2.22” no-resolve
Ron Trunk's user avatar
  • 67.7k
3 votes
Accepted

Netflow vs sampled netflow

For traffic analysis sampled netflow is often used, because 1:1 sampling (or non-sampled) netflow can be quite a burden on both the router sending the flow data and on the flow receiver. Most setups I'...
Teun Vink's user avatar
  • 17.4k
3 votes

SNMP protocol MIBs & OIDs

A device (or its SNMP Agent to be precise) can contain whatever objects it likes. Since many (networked) devices often share common objects (for instance related to the Ethernet interface) they make ...
Jaap Keuter's user avatar
3 votes

Read out down time of switch port

You can query the switch via SNMP to read the ifLastChange field from the standard MIB-2, which gives you the value of the sysUpTime counter when the interface last changed state. You have to read the ...
Jeremy Gibbons's user avatar
3 votes

Decoding wpa-psk traffic with Wireshark

Not sure why wireshark is unable to do this automatically, but you can see the IPv4 header in the "Data" portion: 45 => version/header length 00 => ToS 003b => Length (= 59 bytes) 0000 => ...
mere3ortal's user avatar
  • 2,416
3 votes

Monitoring URL requests on foundation's LAN

We would like to keep an eye on browsing traffic on LAN 192.168.2.0/24, because we don't want guests to visit wrong websites. Instead of "keeping an eye" on specific traffic you should simply block ...
Zac67's user avatar
  • 85.5k
3 votes

What's the inline monitoring?

Inline monitoring would typically imply that some type of traffic capturing device is added in the middle of two points (inline) that traffic traverses. A passive monitoring implementation instead ...
boomi's user avatar
  • 993
3 votes
Accepted

What's the inline monitoring?

With regard to Juniper devices, the answer is right in the document you linked to: When you enable inline monitoring, you can monitor actual IPv4 and IPv6 packets at different sampling rates, and ...
Ron Trunk's user avatar
  • 67.7k
2 votes

How to check MPLS connections?

The short answer is "SNMP" from a network management platform (canonically Nagios, but there's a world of alternatives). You'd be interested in monitoring: The BGP neighbour status of all those ...
vk5tu's user avatar
  • 1,171
2 votes
Accepted

How does a router monitor traffic between two devices on a switch

As per this page: The SonicWALL Packet Monitor feature allows you to capture and examine network traffic as it crosses your firewall. When activated, Packet Monitor logs the details of packets ...
OzNetNerd's user avatar
  • 2,337
2 votes

Sampled Netflow

Most of the DDOS appliance can get input of sampling rate and multiply the values and should be able to detect volume attacks easily. So you don't need to worry about sampling. Most of the ISPs/DDOS ...
user88975's user avatar
  • 517
2 votes

Network traffic

Network traffic is a very generic word , so shortly if you want to dig this field you need to understand two main things. NETWORKING is ADDRESSING this address may be L2 address(mac for example) or ...
Gadeliow's user avatar
  • 3,444
2 votes

More Information from ICMP & ARP

You could potentially get the manufacturer of the NIC from the ARP table, but you need to take the MAC address from the ARP mapping and do a lookup using a 3rd party source to determine the ...
John K.'s user avatar
  • 969
2 votes
Accepted

More Information from ICMP & ARP

Now I need a method for getting Network adapter's manufacturer, DNS Name and Host type from ICMP or ARP. That is not possible. ARP (Address Resolution Protocol) will get the layer-2 address (MAC) ...
Ron Maupin's user avatar
  • 99.9k
2 votes
Accepted

Dell PowerConnect 5524 - SNMP OID for stack topology

Dell has the rlstack.mib. It doesn't seem to exist online (anymore), but can be retrieved from the firmware on Dell Support, or I posted a copy on Gist. Try using a snmpwalk on .1.3.6.1.4.1.89.107 ...
Theo's user avatar
  • 319
2 votes

Extract QoS Buffer Drops via SNMP

If you're just looking for interface output queue drops, you can use the cportQosDropPkts OID (part of CISCO-PORT-QOS-MIB). $ snmptranslate -On CISCO-PORT-QOS-MIB:cportQosDropPkts .1.3.6.1.4.1.9.9....
one.time's user avatar
  • 1,636
2 votes

Cisco 3560 interface counters, are the counters reset automatically?

Last clearing of "show interface" counters never That line is a few above what you provided. Interface counters (in the UI) reset (1) at reload, (2) when explicitly cleared (clear counters), or (3) ...
Ricky's user avatar
  • 32.3k
2 votes
Accepted

Network fluctuation / delay monitoring between two nodes

You didn't say what kind of network this is running over (any tunnelling?) or what speed things are running at, but on the assumption it's not very high (relative to your equipment) ... Consider ...
jonathanjo's user avatar
  • 16.3k
2 votes
Accepted

Decoding wpa-psk traffic with Wireshark

The solution is to ignore the Protection bit. In Preferences -> Protocols -> IEEE 802.11: In found the solution from this old Wireshark mail list.
MasterScrat's user avatar
2 votes

Can I get what filters are applied to an interface via SNMP?

So, it kind of does. I don't have an EX3300 in front of me to test box-specific config, but on an MX at least, you can do this: Your filter needs to have the interface-specific knob enabled and it ...
Benjamin Dale's user avatar
2 votes

Capturing traffic from multiple connections on a switch

This depends largely on your switch. E.g. on HP Provision switches, the monitored ports ingress and egress traffic is copied to the mirror port. When you monitor both port A and port B, you get A->B ...
Zac67's user avatar
  • 85.5k
2 votes
Accepted

How can different views onto same data model be defined in YANG?

While YANG supports imports, that sentence sounds as if it meant that different YANG models might provide access to the same set of underlying non-YANG data in different formats. As a hypothetical ...
Jan Kundrát's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible