Cisco – Monitor specific traffic type on a Cisco router

ciscocisco-commandsmonitoringtroubleshooting

Is it possible to monitor a specific traffic type going through a cisco router? (like monitoring via wireshark)

Ex: I want to monitor http traffic specifically that is passing through a router. (or DNS, FTP, …)

Best Answer

You could monitor the traffic

  • on the router, Cisco IOS 12.4(20)T and later, there is a packet capture feature, with filtering on interface name and direction and ACL.

    • set up an access list for matching the traffic
    • create a capture buffer monitor capture buffer holdpackets filter access-list <number>
    • define a capture point monitor capture point ... possibly with interface name, direction, and more - use the inline help to see possibilities
    • let the traffic pass
    • look at the capture buffer: show monitor capture buffer holdpackets dump, use export instead of dump to get a PCAP file for Wireshark analysis
    • don't forget to stop capturing, remove the capture point and delete the capture buffer afterwards

    For details and examples, follow the link or look at a Cisco troubleshooting manual.

  • on the switchport, where the router is connected to, for this you could set up a mirror port on the switch and monitor this via Wireshark

  • on the firewall, where the traffic passes

    Cisco ASAs are capable of remotely doing packet capturing and giving you the output as a PCAP file which you can open locally with Wireshark. The ASDM provides an assistant for this. Step by step, you can specify source and destionation interface, ACLs or src/dest networks/host, and the protocol you like to watch. That's why I like having ASAs in place everywhere - with a router CLI may seem a bit complicated.

Screenshot of the packet capture wizard