cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
682
Views
10
Helpful
4
Replies

What command line tools used to identify traffic?

Patrick.Beaven
Level 1
Level 1

Does anyone know of any command line tools that can be used to identify traffic type by port and ip addresses with source and destination? I have used ip nbar on routers but dont see it on the Cisco ASA? Is it possible?

4 Replies 4

Hi Patrick,

You can look at the output of 'show conn all' which will show you source and destination IP addresses and ports. Syslogs are also useful to watch connections being built and torn down. Take a look at that output and let us know if that is what you're looking for.

Hope that helps.

-Mike

It is commented in a following message that you can monitor in 'realtime'. But using 'show conn all' would be like a picture? Like a 1 second window? Or instant window?

branfarm1
Level 4
Level 4

You can also use the capture command to look at traffic real-time. It's basically like sniffing the traffic through your firewall, and can be exported to a packet analyzer.

To use the capture feature, first you have to create an access list that matches the traffic you are interested in watching. After that you can execute: capture access-list real-time

I've found that command to be very helpful.

Hope that helps,

--Brandon

Thank you, This is exactly what I was looking for!

Thanks again,

Pat Beaven

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: