Re: Syslog to monitor traffic


"Loren Amelang" <loren@xxxxxxxxxxx> wrote in message
news:lh2d33t5pd1neaslb999mhs09uob8qorru@xxxxxxxxxx
On Mon, 30 Apr 2007 08:15:46 -0500, "Marc" <mhmuray@xxxxxxxxx> wrote:

Basically I want to watch incoming and
outgoing traffic in real time. Know the source, destination, protocol and
action taken (blocked, allowed, etc.)

That's far too much to watch in real time, even on my single-user 804.
What I do is create an access-list and add "log" to transactions I
really want to see:
-----
access-list 121 remark 3389 is remote desktop
access-list 121 permit tcp any eq 3389 any log
access-list 121 remark 5900 is VNC
access-list 121 permit tcp any eq 5900 any log
...
access-list 121 deny ip any any log
-----

set the logging level to include such items:
-----
logging buffered 4096 debugging
ip access-list log-update threshold 1
logging facility syslog
logging 10.1.1.5
-----

and I get entries like this:
-----
Mar 26 14:53:50.580 pdt: %SEC-6-IPACCESSLOGP: list 121 denied tcp
166.114.42.49(1157) -> 68.164.169.15(5900), 1 packet
-----

That is a VNC in the non-permitted direction, that has fallen through
the whole access-list to the "deny ... log" at the bottom.

I can also request summary statistics on matches to each of the
access-list lines:
-----
// statistics on matches to every access list statement
show access-list [list#]
// reset access statistics
clear access-list counters [list#]
-----

Loren

Thanks, Loren. Exactly what I'm looking for.


.

Relevant Pages

  • Re: Syslog to monitor traffic
    ... That's far too much to watch in real time, ... set the logging level to include such items: ... I can also request summary statistics on matches to each of the ... // statistics on matches to every access list statement ...
    (comp.dcom.sys.cisco)
  • Re: Syslog to monitor traffic
    ... That's far too much to watch in real time, ... set the logging level to include such items: ... because you could get an overwhelming amount of entries. ...
    (comp.dcom.sys.cisco)
  • Re: real time traffic chart/graph
    ... use both Google Analytics and AWStats to collect statistics. ... get most hits, which get least hits, etc. ... AWstats is quite capable of doing that although obviously not in real ... Measuring hit counts directly in real time may be a bit tricky ...
    (comp.infosystems.www.servers.unix)
  • Clustered apache logging
    ... Everything works, apart from the logging. ... I would like to be able to get real time access ... Since multiple apache instances cannot write to the same log file, ... Log over a tcp syslog-ng connection to a central host ...
    (comp.infosystems.www.servers.unix)
  • Re: real time traffic chart/graph
    ... use both Google Analytics and AWStats to collect statistics. ... AWstats is quite capable of doing that although obviously not in real ... Measuring hit counts directly in real time may be a bit tricky ...
    (comp.infosystems.www.servers.unix)