Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Logging from Specific IP

Is there a way I can log traffic coming from a specific IP address on my LAN?

  • Other Network Infrastructure Subjects
4 REPLIES
Red

Re: Logging from Specific IP

If it's an IOS device, then you may use the following configuration command (and specify the interface):

logging source

Hall of Fame Super Silver

Re: Logging from Specific IP

Corey

This response interprets your question as wanting to specify the source address for syslog messages sent from this router.

However I interpret your question as being that you want to capture and log messages from some host connected on a LAN that is connected on one of the interfaces on this router. If my interpretation is correct then I have a method to suggest, but I would be very careful about implementing this. The solution that I have in mind involves running debug ip packet. This command can have quite an impact on the performance of your router. So I will suggest combining an access list with the debug to get the results that you want and to minimize the impact of the debug.

Try this:

access-list 199 permit ip host any

debug ip packet 199

It creates an access list which identifies the unique host that you are interested in and applies that access list to limit the debug output to just the packets sourced from that host.

You might achieve your requirement if you could run things like Sniffer (or other packet capture software) on the traffic. But my suggestion is the only thing that I know that you can do on the router itself and achieve what you are asking. While debug ip packet can have quite an impact, combining that debug with an access list does reduce the impact.

HTH

Rick

New Member

Re: Logging from Specific IP

That is exactly what I want to do. Now, does this method create a log file, or is it real time?

Hall of Fame Super Silver

Re: Logging from Specific IP

Corey

This method operates in real time. The messages are sent to syslog. So if you have telnetted to the router and if you have done terminal monitor command then you will see the output in real time. Also if you have configured logging buffered to include debugging level messages you can review the debug output in the logging buffer. And depending on how you have configured your syslog it is possible that you would send the debug output to a syslog server and you can view the file on the server.

HTH

Rick

120
Views
0
Helpful
4
Replies
This widget could not be displayed.