Networks

Ask something
Discussion Locked

Monitoring of Network Traffic

0 helpful
3 replies

by cvivek

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,
At present we have internal, public and NAT Ips. I am able to monitor/ check the visits of sites online through proxy for internal IPS.
Does anyone know a tool which can monitor the same for Public and NAT Ips?
Pl do let me know if u have any tools which are available.
rgds,
vivek

3 replies

by john rea

You will need to gather the addresses from somewhere, at present you are getting the internal ones from a proxy server cause the users "pass through" this. So your common point is the ISP internet router connection, or some other device you want toinsert into the stream.

If the router is a Cisco you can enable IP accounting, this will give you a table of the address source & destinations that were accessed

You can configure this on outbound packets only so you (usually) monitor the outbound packets on the serial ISP link & the outbound packets on the ethernet ( internal facing) link.

Use the command
ip accounting output-packets

You can then issue the SHOW IP ACCOUNTING anytime to see the recent traffic.

Note that ther is a limited buffer available to maintain this table.

If you are good at perl you can have a look at the cisco_ip_accounting.pl part of mrtg that reads this table & processes it.

John

This discussion is closed to new replies.