Solved

Using WireShark with Cisco Hardware

Posted on 2014-07-28
7
420 Views
Last Modified: 2014-08-12
I have used Wireshark in GNS3, where you right click on the link between 2 routers and select capture. This will open up Wireshark and captures all the traffic going through the selected Link.

In Cisco real world, where they use hardware, how would you use Wireshark for the same purpose as in GNS3 ?

Thank you
0
Comment
Question by:jskfan
  • 5
  • 2
7 Comments
 
LVL 3

Accepted Solution

by:
Peter Haussl earned 500 total points
ID: 40224071
On cisco switches you have possiblity to capture so called mirror ports.

Cable will be plugged between mirror port and laptop / pc's ethernet port. and you can listen to traffic appearing on initial port.

In enbled mode you can define like that

Switch(config)# no monitor session 1
Switch(config)# monitor session 1 source interface FastEthernet0/5
Switch(config)# monitor session 1 destination interface FastEthernet0/1
Switch(config)# end


br
Peter
0
 

Author Comment

by:jskfan
ID: 40224810
I checked Cisco Website in order to understand Mirrored ports or the way they call SPAN, it is not clear enough.

Let's say 2 routers are connected to a each other.
do you plug your laptop to an available port on one of the router and configure monitoring ?

how physically can you set up this before starting the monitoring config then Wireshark ?
0
 

Author Comment

by:jskfan
ID: 40226932
I found similar notes on a sheet of paper, I wonder if the comments are correct ?

** Sometimes we'll have to use for instance Wireshark to monitor the traffic generated by a certain device.
Assuming we have Wireshark installed on Laptop, we connect the laptop network adapter cable to a port on a switch where the device to be monitored is plugged into.
Connect to the IP address of the Switch with Telnet or SSH  putty, and run the following commands:

Switch(config)# no monitor session 1
This will disable any previous session 1 if there was one already open.
Switch(config)# monitor session 1 source interface FastEthernet0/5
This configure the port where the device is plugged  to be monitored
 Switch(config)# monitor session 1 destination interface FastEthernet0/1
This configures the port where the laptop is plugged to receive data to be monitored
 Switch(config)# end

Then open up Wireshark, and watch the traffic...
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 3

Assisted Solution

by:Peter Haussl
Peter Haussl earned 500 total points
ID: 40226956
Yes similar to what i tried to explain ...

In different to old faschioned HUBS you usually will find switches.

Different to HUBS packages walking through switches are addressed to specific port.
Which is good in matters of security and performance but quite bad in matters of sniffing the traffic (what you most likely want to do).

Cisco emulators give you for test purposes possiblity to attach you wireshark to any port. This is unfortunately not as it is in real world.

Therfor you need to tell the switch to address the traffic not only one specific port (where address MAC address is connected) but also to a one which is mirrored (this is what configuration mentioned is basically doin)

One hint if you mirror a 2 Gbit fiber channel to a 100 Mbit port you for sure will have troubles (so original port needs to have same speed as mirror port from the definition.)

We used such setup to track some sigtran network (with a lot of traffic) and i was really impressed how good it is working that way.

I hope this was helpful for you

br
Peter
0
 

Author Comment

by:jskfan
ID: 40227142
The dark areas in monitoring are :

if you have 2 Router R1 an R2 are directly connected (no switch in between), you will be using the laptop to catch traffic from one Router at a time, because you plug your laptop to an available port on R1 and you make the port your laptop plugged into as Destination and an available port on R1 where R2  as the source....
here you catch only the traffic received by R1 from R2

Then you move your laptop to R2 and redo the same thing...




if both R1 and R2 are plugged to a switch then you make their ports on the switch as Source.
Switch(config)# monitor session 1 source interface FastEthernet0/5 (where R1 is plugged)
 Switch(config)# monitor session 1 destination interface FastEthernet0/1 (where your laptop is plugged)
Switch(config)# monitor session 1 source interface FastEthernet0/6 (Where R1 is plugged)
 Switch(config)# monitor session 1 destination interface FastEthernet0/1 (Where your laptop is plugged)

I am not sure if that's correct
0
 

Author Comment

by:jskfan
ID: 40227144
sorry , I meant to say here:

Switch(config)# monitor session 1 source interface FastEthernet0/6 (Where R2 is plugged)
0
 

Author Closing Comment

by:jskfan
ID: 40257218
Thanks
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Join & Write a Comment

There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
Getting hacked is no longer a matter or "if you get hacked" — the 2016 cyber threat landscape is now titled "when you get hacked." When it happens — will you be proactive, or reactive?
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now