IPS 4255 - Network Sniffer?

davegon69 · ‎02-12-2007

one of my network engineers has asked if I can use our IPS device as a sniffer to identify specific host to host traffic via a specific port. I am somewhat new to IPS and am looking for some direction

Thanks,

Dave

s.jankowski · ‎02-16-2007

Yes, you can use an IPS for sniffing the packets. Refer the following URL for more information,

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a00807517b1.html

mhellman · ‎02-16-2007

Yes, but there are some limitations. Probably the best way to do this is via the CLI. Login with a normal account on the sensor (not a service account). Use the packet capture command:

sensor# packet capture gigabitEthernet0/0 expression

where is a tcpdump expression. So:

sensor# packet capture gigabitEthernet0/0 expression host 192.168.1.1 and port 80

To get the capture off the sensor, use the "copy packet-file" command. The biggest limitation is the size. I think it's something like 15MB, which isn't always big enough.