about debugging

[ryezak]

Anyone know how to debug to watch the traffic on 1 specific host based on IP address?

I am trying to see where the tcp ports are being blocked on 1 of my servers.

Thanks

 

[mahlad29]

create a standard access-list to match the host, then
type debug ip packet and enter the acl afterwords

 

[mahlad29]

Oh yeah, and apply the acl in and out on the int carrying the traffic

 

[vipergg]

Word of warning , make sure you specify that ACL after the debug ip packet otherwise you run a high risk of burying the router and bringing down the network !

 

[ryezak]

can someone provide me with a sample snippet of code for the acl? I have 63 other ips in the same subnet that I don't want to interupt with this acl.

thanks.

 

[mahlad29]

Hmm, thats not possible, it will block all other ip traffic.

Do this
c2600-1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
c2600-1(config)#
c2600-1(config)#access-list 15 permit any
c2600-1(config)#int "put your int HERE"
c2600-1(config-if)#ip access-group 15 in
c2600-1(config-if)#ip access-group 15 out
c2600-1(config-if)#ex
c2600-1(config)#logging on
c2600-1(config)#logging host x.x.x.x
c2600-1(config)#logging trap informational
c2600-1(config)#logging buffered
c2600-1#debug ip packet 15

That should allow you to capture all ip traffic, thus not interrupting any type of traffic movement, then send all that information to a syslog server where you can sift through it till you find what you want. the logging buffered prevents the router from displaying the debug info on the screen, so your router doesn't explode.

-mike

 

[vipergg]

To debug it would be something like this.

access-list 101 permit ip host 192.168.0.1 any
This is just an example.

On the layer 3 interface for that address range

interface g0/1
ip address 192.168.0.254 255.255.255.0
no ip route cache ---> add this statement


debug ip packet 101 detail

This will only show you the flow to and from the 192.168.0.1 address and thus not bury the router . Do not just do a debug ip packet this will debug every packet in the router which will use all the router resources and possibly hang the box. When finished do "undebug all " command.

 

[mahlad29]

vipergg,
first, thats basically what i wrote. second your directions are not complete. It will not work without applying the acl it to an interface. Third that will do exactly what he did not want Interrupt traffic for other hosts.



Also ryzek.

the command logging informational shold be debugging.

Then type no logging console.

20 yrs old, working towards my CCNP. Looking for a new job
02472