Traffic for every IP-Adress

[lsicforum]

Hello all,

We have PIX515 (Software 6.1(3)) with one inside und one outside interfaces. We use NAT. That is our inside network 192.168.0.0 (255.255.255.0) uses one outside ip-adress for example 200.100.100.150.

so i have follow question:

is it possible to show or to control how much traffic does every inside client through PIX for one month? I have found only "show traffic", bur it shows the traffic for all since newstart.

Thank you in advance!

 

[haknwak]

I think you'll need to enable syslog and use a thrid party
log monitor/analysis proggie.

I use Insideout -

http://www.stonylakesolutions.com

- it's
nice and does the job but a little pricey

Also Kiwi syslog talks Cisco as well - it's cheaper -
gives you text output and you parse it as required with
excel or access -

http://www.kiwisyslog.com/info_syslog.htm

"If you lived here, you'd be home by now!"

George Carlin

 

[lsicforum]

haknwak,

Thank you!

I hoped pix can show this info oneself, but it doesn't seem to be so. OK, I installed KiWiSysLog. What I need now the logging level right to set up. Does anybody know what logging level I need for the traffic info?

 

[haknwak]

I log informational (I think it's level 6)

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_61/syslog/pixemint.htm

- and, depending on your activity level, the files will grow quite large. Make sure you tell Kiwi to create a new file daily if it's busy so you can back up and manipulate them more easily.

"If you lived here, you'd be home by now!"

George Carlin

 

[lsicforum]

hawk, thank you!

I will try it.

 

[pabica]

Syslog everything... set level seven... send it to a syslog server (Kiwi makes the Win standard)... and then you will have to use grep to find all the connections for each internal IP...

You end up with messages for the begining of each connection, the teardown of each connection and IP addresses and ports (and bytes transfered and time connected for TCP connections)...

all kinds of cool information but a fair amount of work to extract and present in a meaningful manner...

My tools are grep, perl, excel and sometimes access as a database... the combination (with some work) makes great prestnations to management...

Good luck,
Bill..