Closely monitor traffic

[mufka]

Is there a way that i can closely monitor traffic going thfrough my 1601 router? it's plugged into a 24 port switch with about 15 hosts on it. Can I set something up that will log where a specific host is talking to? I probably wouldn't want it on all the time but I could turn it on when I see something fishy.

 

[wybnormal]

It's called a Sniffer Set up a filter for the source with it catching anything the source IP talks to. THere are other items like NetRanger or Net Foresenics that can get alot of detail about who is talking to who and how.

You could do something with access-lists but it would not be detailed like I think you are asking for.

MikeS
"Diplomacy; the art of saying 'nice doggie' till you can find a rock" Wynn Catlin

 

[mufka]

I thought I couldn't sniff a switch?

 

[wybnormal]

Not true.. a switch is a layer two device... ie.. it reads MACs. The difference from a sniffer perspective between a switch and a bridge/hub is that the switch is really made up of a bunch of bridges.. 1 per port. So you can sniff *a* port and see whatever is on that one link.. or you can on some switches throw a port into "monitor mode" which get a mirror of traffic sent to it.. or.. you can toss a hub on the uplink side and grab what is going out somewhere else. Keep in mind that any traffic on the switch that is port to port, you would miss on the uplink. The traffic that does traverse the switch is broadcast traffic or multicast traffic.

Some switch will also let you monitor per VLAN which is very handy.

MikeS
"Diplomacy; the art of saying 'nice doggie' till you can find a rock" Wynn Catlin

 

[Guest_imported]

What about some ip accounting ??