It Jobs Working From Home

Monitoring traffic is like a packet capture. Here are a couple ways you can monitor traffic with a Cisco Switch.

Plug your laptop into any source port and start sniffing packets with wireshark.org Represents the session number and must match for both source and destination interfaces, in this example 1, the number behind the session. Monitor Session VLAN access maps Monitor Session can be done on just about all Cisco switches however there is a limit to the number of monitor session you can use at any given moment.

Monitor session 1 source interface fastethernet 0/2 monitor session 1 destination interface fastethernet 0/3

VLAN Access maps

VLAN Access maps also don't hit the switches CPU near as hard as monitor sessions. They allow for more granular control over your packet capture and take place at wire speed. VLAN access maps are pretty cool.

In this example we WON'T cpature SSH traffic from certain hosts but will monitor everything else. Further down I'll explain the commands more in depth. . Here are the commands to use.

Vlan access-map part1 5 match ip address MONEY action forward

Vlan access-map part1 10 match ip address EVERYTHINGELSE action forward capture

9-10 vlan filter part1 vlan-list 1-5,

Ip access-list extended MONEY permit tcp host 10.90.12.24 host 10.90.24.7 eq ssh permit tcp host 10.90.12.24 host 10.90.24.5 eq ssh permit tcp host 10.70.24.7 host 10.90.24.24 eq ssh permit tcp host 10.70.224.5 host 10.90.27.24 eq ssh permit tcp 192.168.20.0 0.0.0.255 host 10.91.4.7 eq ssh ip access-list extended EVERYTHINGELSE permit ip any any

# vlan 999 # remote-span # interface vlan 999 # exit # vlan filter FILTER vlan-list 999 # interface gi9/32 # switchport access vlan 999

How to use this VLAN access map to sniff or monitor network traffic

Is the lowest number the access map will action forward the packets based on which packets match access list MONEY; since "5&Prime. ; in ascending order based on the number next to the index "part1″ the VLAN Access map will act upon "part1&Prime. The part1 used below is just an index or name for this packet capture.

Vlan access-map part1 5 match ip address MONEY action forward

The packets from the previous ACL have already been forwarded (because they got forwarded at sequence #5) therefore they will not be captured. The switch will forward and capture the packets which match the packets identified in access list EVERYTHINGELSE. Used in this access map; since it is the next highest number after"5″ now vlan access map part1 is going to act on number "10&Prime.

Vlan access-map part1 10 match ip address EVERYTHINGELSE action forward capture

9-10 (these are the VLANs which carry the traffic you want to sniff / capture / monitor) ip access-list extended MONEY (this is traffic you DON'T want to monitor) permit tcp host 10.90.12.24 host 10.90.24.7 eq ssh now apply the VACL filter to your RSPAN vlan vlan filter part1 vlan-list 1-5,

# vlan 999 # remote-span # interface vlan 999 # exit # vlan filter FILTER vlan-list 999

Now put your IPS interface into the RSPAN vlan

# interface gi9/32 # switchport access vlan 999

Wireshark or whatever monitoring device you have into interface gi9/32 and let the packet capture being, sNORT, nOW of course plug your Cisco IPS.