1700 rxload 1

[nix45]

I noticed that the rxload (show int ser0) on a 1721 router was consistently at around 100/255 at a time when no one was logged in at that office. Can I enable debugging to see exactly what is being passed through the router? I want to see the source and destination of the packets being sent. I have no idea what could be causing the load to be this high. The router is on a 256K frame connection. It eventually dropped down to a low number after a few minutes.

Thanks,
Chris

 

[gconnect]

sure here is how you do it.

when the rx load is high in times of suspicion:

config t
access-list 122 permit tcp any any log-input
access-list 122 permit udp any any log-input
access-list 122 permit icmp any any log-input

interface e0 (or whatever is the outside)
no ip route-cache (so that all pkts are process-switched)
exit

logging console debugging
debug ip packet 122
exit

term monitor (if over telnet)

 

[nix45]

Thanks, that worked.

 

[gconnect]

if you don't want to flood your console screen

it is also a good idea to log to a syslog server


logging host X.X.X.X (internal pc with syslog server)
logging trap debugging (temporary until you have your data, then set it to a better level like warnings or informational)

on my windows boxes, i use kiwi, it is free and runs great on any windows platform

http://www.kiwisyslog.com/

 

[nix45]

Cool, I'll have to try that out. I use Linux though, not Windows. You can probably log to the syslog daemon in Linux, I'll have to look into that.

Chris

 

[gconnect]

you sure can.
i love linux, i am building an snmp station right now on redhat 7.3

as far as syslog, if you are logging from a router directly connected to the LAN with the syslog server then it is no problem

if you are logging over a wan you may have to start syslog to do remote logging

________________________________________________________
p.s.

for kicks (and if you are into exploration and net security), try this (if you have snmpd installed on your nix box and your router)

cd /var/log
touch snmpdata1720.txt
chmod 766 snmpdata1720.txt

cd /usr/bin
snmpwalk -v 1 -c public(yourROpwordontherouter) X.X.X.X(RouterIP) > /var/log/snmpdata1720.txt

snmpwalk -v 1 -c public 10.1.1.1 > /var/log/snmpdata1720.txt

and let'er rip (it'll take all of the router's snmp variables and dump it into the text file)