How do I trace traffic source?

[alanmsv1234]

I have a site-2-site IPSec vpn between an 1801 ISR and an ASA 5510. Monitoring the vpn on the ASA, I see there is constant traffic on it, when I would have expected only intermittent traffic. How can I trace what is actually causing traffic to cross the vpn? I suspect something at the ISR end is sending packets to the ASA network, but how can I find out what?

Cheers

[Martin Bosch]

Hi Alan,

I dont know if you have a netflow box but if you do have a look at this.

http://www.cisco.com/en/US/docs/ios/fnetflow/configuration/guide/get_start_cfg_fnflow_ps6441_TSD_Products_Configuration_Guide_Chapter.html

[alanmsv1234]

Hi,

I don't have a Netflow box, and it looks very complicated!!

What I really need is a simple metod of tracing the source IP of traffic going through the VPN.

[alanmsv1234]

Found the answer: Packet capture wizard in the ASA can track all packets between any interface or IP address/range. By capturing from the source subnet, then sending the output to Wireshark, the culprit is revealed.

[Martin Bosch · Accepted solution]

Cool