What command line tools used to identify traffic?

Unanswered Question
Aug 19th, 2008

Does anyone know of any command line tools that can be used to identify traffic type by port and ip addresses with source and destination? I have used ip nbar on routers but dont see it on the Cisco ASA? Is it possible?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
robertson.michael Tue, 08/19/2008 - 11:08

Hi Patrick,

You can look at the output of 'show conn all' which will show you source and destination IP addresses and ports. Syslogs are also useful to watch connections being built and torn down. Take a look at that output and let us know if that is what you're looking for.

Hope that helps.

-Mike

netperception Mon, 08/25/2008 - 10:48

It is commented in a following message that you can monitor in 'realtime'. But using 'show conn all' would be like a picture? Like a 1 second window? Or instant window?

branfarm1 Wed, 08/20/2008 - 13:55

You can also use the capture command to look at traffic real-time. It's basically like sniffing the traffic through your firewall, and can be exported to a packet analyzer.

To use the capture feature, first you have to create an access list that matches the traffic you are interested in watching. After that you can execute: capture access-list real-time

I've found that command to be very helpful.

Hope that helps,

--Brandon

Actions

This Discussion