Monitoring TCP ports

[brianbhc1]

Utilizing a 1605, is there a MIB or another way to show amount of traffic by tcp or udp port on a particular interface?

[Richard Burts]

Brian

Depending on what you want there might be several alternatives that could give it to you. I would suggest starting with the show ip traffic command and see if that gives you enough. If not you might look at configuring IP accounting and see how close that gets to what you need. You might also look at configuring NetFlow which can give some statictics by protocol.

HTH

Rick

[brianbhc1]

I understand what you are suggesting, however I'm looking for reporting on specific tcp ports.

[Richard Burts]

Brian

If you want reporting on specific TCP ports and packet count is sufficient then an alternative to consider would be to create an access list and assign it to the interface (depending on your requirements you might want one access list for inbound and a similar access list for outbound). This access list would not necessarily deny anything. But it would have permit statements for the particular tcp ports that you are interested in and a permit any at the bottom. This way the access list would count packets for the TCP (or UDP) port.

An example would be this:

ip access-list extended count_in

remark count tcp packets inbound

permit tcp any any eq 23

permit tcp any any eq 80

permit tcp any eq 23 any

permit tcp any eq 80 any

permit any any

ip access-list extended count_out

remark count tcp packets outbound

permit tcp any any eq 23

permit tcp any any eq 80

permit tcp any eq 23 any

permit tcp any eq 80 any

permit any any

!

interface fastethernet0/0

ip access-group count_in in

ip access-group count_out out

then show access-list count_in and show access-list count_out would show the number of hits for each line and you would have packet counts for your specific TCP ports.

HTH

Rick

[mdouglasx]

NBAR might be an option. Put this on the interface you want stats on : "ip nbar protocol-discovery". Look at the stats with : "show ip cache flow".

[sundar.palaniappan]

Hi,

Agree. 'ip nbar protocol-discovery' is a cool command and will display stats of all protocols and the corresponding packet counters. But, the command to display the stats is 'show ip nbar protocol-discovery'.

HTH,

Sundar