See trafic on a cisco 1700 eth0 interface ?

Mar 16, 2009 3 Replies

Hi



can i see this information on a cisco 1721 :


- Show all mac with in/out octets used



- shall all tcp trafic on a interface (tcpdump made in cisco)



thanks


Enabling tcp route cache-flow on the interface will enable you to do a show ip cache-flow (I think that is the syntax) which will show current sessions w/ source & destination (same as info sent to netflow). But it will not do a tcpdump which is effectively a sniffer which shows all traffic/packets/frames going in/out an interface. It will also not show mac that I know of.

The very latest n greatest [12.4(20)T or thereby]

*does* have a packet capture facility. Exports to pcap format, so you can view in Wireshark etc. - couldn't have done it better myself:)

Of course that probably won't run on a 1700.

There is also "ip accounting".

With the Netflow mentioned above it is necessary to do "netflow export" and use external third party (some free) tools to import and view the data. Search for [netflow export], [netflow accounting] say. This does work quite well.

None of the accounting tools show the mac directly. They are IP based.

ip route-cache flow, not tcp route cache-flow

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required