Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Viewing of iplog Logs

I was told in a current TAC case that to view the iplogs you can use Ethereal. Ethereal is great, but it doesn't open the iplogs.

I'm using v0.8.7 and get a "not in a recognized file format" error msg when I try to open an iplog file.

It's not tcpdump either, what should I be using to view these files?

3 REPLIES
New Member

Re: Viewing of iplog Logs

I added support for CSIDS IPLog format to ethereal starting in version 0.8.12. If you get the latest version from www.ethereal.com you should be able to read the file.

To check on changes to ethereal, you can watch http://www.ethereal.com/ChangeLog

Please let me know if you have trouble opening the log after you have upgraded to a version >= 0.8.12.

New Member

Re: Viewing of iplog Logs

If you are talking about the log files that are stored on the sensor, (log.20010426####) they are comma delimited and can be read in excel or anything that reads SDF files. If you are talking about the event database on CSPM, they are in a database format, and good luck finding something to read them.

Cisco Employee

Re: Viewing of iplog Logs

The nice thing about ethereal is that it will parse the iplog files and do packet decode. It can also write the iplogs back out in pcap format (useful with TCPDUMP) for replay (have to hack TCPDUMP to add MAC info).

122
Views
0
Helpful
3
Replies