пятница, 3 июля 2015 г.

Embedded packet capture Cisco IOS

My router cisco ISR GR 2921 have very high CPU consumption. To investigate this trouble i want to analyze traffic on that device, i can use SPAN/RSPAN and client host to collect dumped traffic, but if i haven't time host to collect dump, i use EPC Embedded Packet Capture (EPC) is a packet capture facility that allows network administrators to capture packets flowing to, through, and from the device and to analyze them locally or save and export them for offline analysis by using a tool such as Wireshark.EPC simplifies network operations by allowing devices to become active participants in the management and operation of the network. This feature facilitates troubleshooting by gathering information about the packet format. This feature also facilitates application analysis and security.
Optional (buffer size)
monitor capture buffer <name> size <value> max-size <value> circular
Optional capture can filter packet only from accepted hosts
monitor capture buffer <name> filter access-list < ACL name>
Point of monitoring, also can be a interface
monitor capture point ip process-switched cisco both
connect buffer to the captue point 
monitor capture point associate cisco cisco
start dumping traffics
monitor capture point start cisco wait a minute to capture all traffic from the process switched 
monitor capture point stop cisco
save dumped file to your ftp /tftp server as *.pcap
monitor capture buffer cisco export <server>/<filename>
then open that file in Wireshark and investigate anomaly in the traffic

Комментариев нет:

Отправить комментарий