Solved

Wireshark usage: How to get stats on cisco router

Posted on 2008-10-29
15
942 Views
Last Modified: 2013-12-07
I am new to wireshark and want to get some stats (like DHCP, ARP) on cisco router. When I telnet into the router using the broadcom port of my laptop, I only get the activity showing TELNET/TCP? Is there any way to get the router activity esp for E0/0?? Any pointers on wireshark usage will be highly appreciated.
0
Comment
Question by:totaram
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 7
15 Comments
 
LVL 20

Expert Comment

by:RPPreacher
ID: 22834096
Actually netflow is more what you are looking for.

Scrutinizer is a free netflow analyzer.
http://www.plixer.com/products/free-netflow.php

Which Cisco router do you have?  I can help with the netflow set up or you can just google "netflow" and your router model.
0
 
LVL 3

Expert Comment

by:mrwalker15
ID: 22834123
You could also set a SPAN port on you switch to send all the traffic from the routers port to your port.
0
 

Author Comment

by:totaram
ID: 22834297
We have Cisco 2811, and are facing some issues with DHCP allocation from server. Just want to get the trace of the DHCP requests and responses. On google search, I came up @ Cisco IOS Netflow, is that what you are referring to? Prabably, we have to buy that from Cisco....
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:totaram
ID: 22834317
How do you put SPAN on switch port to go thru router to my laptop/PC port?
0
 
LVL 3

Expert Comment

by:mrwalker15
ID: 22834329
What switch do you use?
0
 
LVL 3

Expert Comment

by:mrwalker15
ID: 22834354
Also, are you connected to the same switch as the routers?
0
 

Author Comment

by:totaram
ID: 22834357
Cisco switch 2950, IOS 12.1(20)
0
 
LVL 3

Expert Comment

by:mrwalker15
ID: 22834377
C2950#configure terminal
C2950(config)#
C2950(config)#monitor session 1 source interface <router's interface>
C2950(config)#monitor session 1 destination interface <laptop's interface>

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#topic5
0
 

Author Comment

by:totaram
ID: 22835489
mrwalker, I can not directly log in to switch, I can log in to router from my laptop/PC and then to switch. Is there any way to set the destination interface?
0
 
LVL 3

Expert Comment

by:mrwalker15
ID: 22835571
is your machine physically connected to the same switch? if so, you have to assign the interface that your physically connected as the destination interface.
0
 

Author Comment

by:totaram
ID: 22835652
No, we are miles away from Router/switch. I telnet to the router.
0
 
LVL 3

Accepted Solution

by:
mrwalker15 earned 125 total points
ID: 22835763
Ok. I take you are on the same internal network but on different locations.

You will have to use RSPAN then.

Basically it is the same as a SPAN session but with the destination being on another switch.

You need to create a VLAN to carry the SPAN traffic and it must be available in both switches.

Router's Switch#configure terminal
Router's Switch(config)#
Router's Switch(config)#monitor session 1 source interface <router's interface>
Router's Switch(config)#monitor session 1 destination remote vlan <vlan id that you created>

Your switch#config t
Your switch#monitor session 1 source remote vlan <vlan id that you created>
Your switch#monitor session 1 destination interface <your interface>
0
 

Author Closing Comment

by:totaram
ID: 31511319
Very good, thank you so much for your input,
0
 

Author Comment

by:totaram
ID: 22864593
The issue is closed.
0

Featured Post

Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The Samsung SSD 840 EVO and 840 EVO mSATA have a well-known problem with a drop in read performance. I first learned about this in an interesting thread here at Experts Exchange: http://www.experts-exchange.com/Hardware/Storage/Hard_Drives/Q_2852…
PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …
Suggested Courses

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question