36

The client switchport or the server switchport can be monitored. A third switchport can be configured as a mirror port. This means that this mirror port will receive copies of all packets on the corresponding original port, while the original traffic won't be affected. For example, on the Catalyst 3560: Enter configuration mode: conf t Define the source ...


22

NetFlow is a protocol for exporting aggregated IP flow totals. As such it is well suited to IP traffic accounting on Internet routers. With Netflow V9 (AKA IPFIX it can look into Layer 2 traffic as well) sFlow is a general purpose network traffic measurement system technology. sFlow is designed to be embedded in any network device and to provide continuous ...


19

(having worked with this for a decade now) Hands down, the biggest functional difference between a tap and a span... a passive tap will never, ever drop a frame, under any circumstances -- it electrically duplicates the frame, errors and all. Active taps (regenerative, or aggregate) can drop frames, eg. if the bidirectional traffic exceeds the link speed ...


17

If your traffic happened to be passing through a router running Cisco IOS 12.4(20)T or greater, another possibility is to use the Embedded Packet Capture feature. This feature is NOT available on switch platforms like the 3560 or 3750. What this feature does is capture and save a small PCAP file on the router that you can download and analyze with ...


15

There are a few examples that can do this. Cacti is one. It has a weather-map plugin that can be leveraged to produce output such as the following GigaPop Illinois Wisconsin University These are examples of what the weather map plugin can do. When configured correctly you can see minute, hourly, daily, weekly and monthly traffic stats. You can download ...


14

You've got great replies so far. Like Lukasz says the buffer setup is a bit complex on the Catalyst switches. There is a pool that you assign buffers from for the 4 egress queues. You can choose to reserve a certain amount of buffers and let the rest sit in a pool and use it as needed. The buffers that are reserved can't be touched by other queues/...


14

That depends on the switch model you have and it's not that easy. Smaller Catalyst switches in general use at least two forms of buffer - there's usually a interface-lavel buffer, on the smaller Catalyst (2k/3k) visible in 'show buffers' under the section named 'Interface buffer pools:': Interface buffer pools: Syslog ED Pool buffers, 600 bytes (total 132, ...


14

With nmap scan, you usually get 3 states: Open - remote computer responded with a SYN/ACK to your SYN Closed - remote computer rejected your connection attempt with a RST packet Filtered - nothing came back, timeout occured Opening a netcat to port 80 and waiting will not do anything. Port 80 (usually) means a http server is listening on the other side, ...


13

You could monitor the traffic on the router, Cisco IOS 12.4(20)T and later, there is a packet capture feature, with filtering on interface name and direction and ACL. set up an access list for matching the traffic create a capture buffer monitor capture buffer holdpackets filter access-list <number> define a capture point monitor capture point ... ...


12

On Cisco devices, you can use Cisco IP SLA. You need to first configure and enable it, and then monitor the results. Steps: 1. ip sla monitor operation-number 2. type echo protocol ipIcmpEcho {destination-ip-address | destination-hostname} [source-ipaddr {ip-address | hostname} | source-interface interface-name] 3. frequency seconds 4. ip sla monitor ...


11

Even though SPAN can (will) drop frames when TAP would not, Cisco switches (and maybe others) have a cool feature called RSPAN. It allows to set up a remote SPAN, to transport captured frames over the network to the monitoring station:


11

If you are getting buffer failures, I would use a command like the following: show interface | i (line protocol|no buffer) You will need to manually sort through the output a bit, but you are looking for lines were you have more than 0 no buffer errors like this: FasttEthernet0/24 is up, line protocol is up (connected) 1557332164 packets input, ...


11

To extend ytti's comment. Your poll interval seems really small, every 10 seconds if I'm reading right. There's a few reasons you could get that result. Equipment side: Bad choice of counters, if you're using 32-bit counters they could be rolling over every ~3.4 seconds if you're running a 10g interface at line rate Counter updating, many larger devices ...


9

There are a couple of options, depending on how much traffic you will receive: If you're going to receive a lot of traffic, should use gulp, which runs on linux; gulp requires the linux pf_ring kernel module. If the bandwidth requirements are reasonable, you could simply use your laptop with wireshark's ERSPAN decoder; wireshark can see the protocols inside ...


9

In Infrastructure/ESS mode, it doesn't make much sense to capture packets going to other stations in promiscuous mode, for several reasons : The 802.11 ESS operation assumes that, in a BSS, all non-AP stations must send all their packets to the AP, regardless of the destination address. This is implemented as follows: if a station wants to communicate with ...


9

Two possible choices... a packet capture tap (which is quite viable) or packet capture on the ASA. If you're not interested in buying a tap and inserting it inline, you shouldn't be afraid of capturing on your Cisco PIX. To capture traffic on the PIX, first define an ACL... assume you're trying to capture traffic from a host inside the firewall at 10.10.10....


8

According to the FastIron config guide: If the primary interface of a trunk is enabled for monitoring, the entire trunk will be monitored. You can also enable an individual trunk port for monitoring using the config-trunk-ind command Trunk in this sense being the FastIron term for an aggregated interface. If this didn't work you could use a TAP, or ...


8

Have a look at this IOSHints post: CLI command logging without TACACS+. And the title seems to imply it can also be done with TACACS+.


8

Assuming you are using TACACS+ you can configure: tacacs-server host x.x.x.x key xxxxx aaa accounting commands 0 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ Also include a line for any other enable levels that you may use.


8

The FVS338 firewall has SNMP v1 and v2c support according to the Netgear documentation on it (listed under Management Features). The FS726T switch also supports SNMP v1 according to it's documentation (listed under Administrative Switch Management). Therefore, any number of free or paid NMS systems could give you the graphical information you're looking ...


8

A closed port is a port that doesn't have any software listening on it, so an attempt to make a connection to that port on that system will result in the system sending back a TCP RST packet. A filtered port, on the other hand is typically a port that is blocked by a firewall in the network path, so an attempt to make a connection to that port on that ...


7

In my experience physical network taps give you much more flexibility. Many Cisco platforms have restrictions on the number of SPAN ports/monitoring sessions. By using physical network taps you're able to directly monitor several different ports without using CPU overhead on the Cisco device itself. Also worth considering is the cost for physical taps. ...


7

The best solution is to plug a computer running a packet analysis software like Wireshark to an unused port and duplicate the traffic to this port. This is called mirroring and monitoring. Here is how to do this on a Brocade MLX, XMR, CER or CES : First configure the mirroring port. This is the port you will plug you packet analyzer, ethe 3/1 here. Brocade(...


7

Wow, this question could be an entire site of its own. Regardless of what software package(s) you end up using, if snmp is how you're getting your numbers, it's time to embrace sFlow (aka: NetFlow depending on your hardware). I love snmp. It's perfect for getting a plethora of network (and other) statistics. That said, if you want a deeper look into your ...


7

The sole difference being "NetFlow is Cisco proprietary, sFlow is not" isn't exactly correct. NetFlow originally started out as Cisco proprietary, but kind of went the same way as GRE or EIGRP. Since NetFlow v5 it has been implemented and supported on other vendors' hardware. The main difference between NetFlow and sFlow is that NetFlow is restricted to IP ...


7

Generally speaking you can install MRTG or any network graphing and historical data software which can pull interface statistics via SNMP. A nice and easy free software for this is CactiEZ. It can be easily run out of the box on an old server or mounted and installed easily on a VM. However, since you're using a Cisco router, you can enable NetFlow on your ...


6

Cacti is a good open source solution. You will need some Linux experience to get up and running. PRTG is a nice solution, can't be the price. You can use SNMP to monitor interfaces and it now also includes Netflow. Probably not the most robust reporting, but a good starting point for the price. SolarWinds is another huge player. Great features and ...


6

They keep moving things into the web interface but the reports are in a separate app called "Report Writer" on the server desktop so you'll have to RDP or physically connect to the server to get to it. There's also a "Report Scheduler" where you'll need add the reports once you've created them. I've never found their reporting very useful but you may have ...


6

Your problem is as such, that your router sampling and your own polling are not hitting the same moment. That is, even though polling interval is static, polling intervals contain different amount of samples, which your math does not take into account. Consider you've polled t1,t2,t3 but router didn't sample anything at t1,t2 interval, so all of the traffic ...


6

What you are describing is IP Source Route. However, any network with even a hint of security will have source-route disabled. But if you want to try it anyway, keep in mind there's a limit to the size of an IP header, and thus, a limit to the number of hops you can specify.


Only top voted, non community-wiki answers of a minimum length are eligible