What command line tools used to identify traffic?

Unanswered Question
Aug 19th, 2008
User Badges:

Does anyone know of any command line tools that can be used to identify traffic type by port and ip addresses with source and destination? I have used ip nbar on routers but dont see it on the Cisco ASA? Is it possible?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
robertson.michael Tue, 08/19/2008 - 11:08
User Badges:
  • Silver, 250 points or more

Hi Patrick,

You can look at the output of 'show conn all' which will show you source and destination IP addresses and ports. Syslogs are also useful to watch connections being built and torn down. Take a look at that output and let us know if that is what you're looking for.

Hope that helps.


netperception Mon, 08/25/2008 - 10:48
User Badges:

It is commented in a following message that you can monitor in 'realtime'. But using 'show conn all' would be like a picture? Like a 1 second window? Or instant window?

branfarm1 Wed, 08/20/2008 - 13:55
User Badges:
  • Bronze, 100 points or more

You can also use the capture command to look at traffic real-time. It's basically like sniffing the traffic through your firewall, and can be exported to a packet analyzer.

To use the capture feature, first you have to create an access list that matches the traffic you are interested in watching. After that you can execute: capture access-list real-time

I've found that command to be very helpful.

Hope that helps,


Patrick.Beaven Mon, 08/25/2008 - 06:39
User Badges:

Thank you, This is exactly what I was looking for!

Thanks again,

Pat Beaven


This Discussion