Span a WAN interface on a router

[kraghavansag]

I have a router with 3 interfaces. 2 G/E interfaces and 1 T1 (serial interface) for a MPLS link. Is it possible to span the traffic for the MPLS link which is connected to the T1 controller card and send it via one of the G/E interfaces to the internal network? Simply put, how do I span the MPLS traffic?

[kraghavansag]

the router is a 2821 model.

[Giuseppe Larosa]

Hello Kartick,

netflow is the right tool here as suggested by Craig.

It provides detailed flow based statistics rather then replicating traffic to a sniffer.

Accounting data about observed flows are sent to a collector in UDP packets.

to be noted that some information can be gathered from the router itself.

Hope to help

Giuseppe

[xcz504d1114]

SPAN ports are configured on switches using the monitor session command set.

If you are looking for information from a L3 device, you are looking for netflow information.

You will need a device setup to recieve the netflow traffic (software is available on the internet)

And you will need to configure your router to send netflow data to your collection engine.

http://www.cisco.com/en/US/docs/ios/netflow/configuration/guide/cfg_nflow_data_expt_ps6350_TSD_Products_Configuration_Guide_Chapter.html#wp1057653

HTH,

Craig

[kraghavansag]

Hi Guys,

Thanks for your help. I have netflow packets sent to a bandwidth monitoring server. I was looking out to span raw data going out on the serial interface and send it to another device which we are using for recording. It looks like there is no way to do that. Appreciate all your help.

[xcz504d1114]

The only way to grab the raw data is to setup a SPAN port on the switches that connect to the GE interfaces of your router and capture the traffic as it enters and leaves the switches.

HTH,

Craig

[kraghavansag]

Hi Craig,

I have done that. I am able to capture the raw data coming in and going out of the GE interfaces. But I am not able to do it for the serial interface where the MPLS link is connected.

[rshum]

You can't span it because it's not on a switch. Since you have multiple LAN interfaces you'd have to know what interface the packets are entering and exiting the router from.

Some sniffers have a T1 interface that you can use in the DSX patch ports. It would depend on the sniffer you are using and the available interfaces on it.

[vincent_telus]

You could use ip traffic-export. You just need the MAC Address of the destination (sniffer). Just set the output interface to one of the gig ports connected to the sniffer.