too large default traffic

Just Kennie · ‎08-11-2008

pls i need to know what is passing thru my router, using 'sh nbar ...' giv few information , and majority of the traffic are classified as default, is there any way i can make the router do more traffic identificatiion and less default .

rkhalil · ‎08-11-2008

Upgrade your IOS version , the new versions support more protocols... or use Cisco NetFlow or SPAN / PORT MIRROR in your switch for sniff your traffic.

--

Regards,

Raul

(please rate helpful posts)

Just Kennie · ‎08-11-2008

Please can u tell me how to use this switch command

rkhalil · ‎08-11-2008

IOS Config example:

router(config)#monitor session 1 source interface fastethernet 4/2

!--- This configures interface Fast Ethernet 4/2 as source port.

router(config)#monitor session 1 destination interface fastethernet 4/3

!--- The configures interface Fast Ethernet 4/3 as destination port.

For more information visit:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml

--

Regards,

Raul

(please rate helpful posts)

Joseph W. Doherty · ‎08-11-2008

At least on the software routers, there's an NBAR (debug?) option for it to break down unknown traffic by UDP or TCP and port number beyond what NBAR discovery recognizes. This will provide an additional view what's passing through the router.

Once you identified certain traffic of interest, you can define custom NBAR to classify that traffic.

Also, depending on what version of IOS you're using, PDLMs can increase the traffic types that NBAR recognizes.

Just Kennie · ‎08-14-2008

can u pls explain or give me the commands to do the nbar option.

Joseph W. Doherty · ‎08-14-2008

See if this helps: http://www.cisco.com/en/US/tech/tk543/tk757/technologies_tech_note09186a0080094ac5.shtml