I currently have a site connected via a T1 and it is getting flooded. Is there a command that I can run on the 1721 Router that will show all connections so that I can identify the source / destination IP addresses of all traffic? I tried "show connections" but that didn't have the info that I needed.
Thanks in advance!
Solved! Go to Solution.
Please post show version from this router as NetFlow may be a suggestion but it depends on the software release.
You can also turn ip accounting on the serial interface.
Attached is the 'show version'
Cisco Internetwork Operating System Software
IOS (tm) C1700 Software (C1700-K9O3SY7-M), Version 12.2(8)T1, RELEASE SOFTWARE (fc2)
TAC Support: http://www.cisco.com/tac
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Sat 30-Mar-02 14:18 by ccai
Image text-base: 0x80008108, data-base: 0x80D2C08C
ROM: System Bootstrap, Version 12.2(7r)XM1, RELEASE SOFTWARE (fc1)
pob-1721 uptime is 23 minutes
System returned to ROM by reload at 09:56:54 CST Fri Dec 14 2007
System restarted at 09:58:24 CST Fri Dec 14 2007
System image file is "flash:c1700-k9o3sy7-mz.122-8.T1.bin"
cisco 1721 (MPC860P) processor (revision 0x100) with 44237K/4915K bytes of memory.
Processor board ID FOC06150DEF (1625455792), with hardware revision 0000
MPC860P processor: part number 5, mask 2
X.25 software, Version 3.0.0.
1 FastEthernet/IEEE 802.3 interface(s)
1 Serial network interface(s)
1 Virtual Private Network (VPN) Module(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read/Write)
Configuration register is 0x2102
Your IOS supports NetFlow, please read the docs.
Thank you so much! I was able to use the Netflow data to track down the culprit!
I can tell that I will be using this a lot in the future!
As far as IP Accounting, we don't have any ACLs on the system, and it looks like IP Accounting only tracks failures agains the ACLs. Is that correct?