Information Technology Reference
In-Depth Information
6.
Disable fast-switching on the inbound and outbound interfaces from which you would like to
capture traffic.
CiscoRtr#
configure terminal
CiscoRtr(config)#
interface ethernet 0
CiscoRtr(config-if)#
no ip route-cache
CiscoRtr(config-if)#
interface ethernet 1
CiscoRtr(config-if)#
no ip route-cache
CiscoRtr(config-if)#
end
CiscoRtr#
7.
Create an access list that matches
only
the traffic that you want to capture. In this example, we are
using access list 101 to match all DHCP traffic. The number 101 should be replaced with an
available IP access list on your router.
CiscoRtr#
configure terminal
CiscoRtr(config)#
access-list 101 permit udp any any eq bootpc
CiscoRtr(config)#
access-list 101 permit udp any any eq bootps
CiscoRtr(config)#
access-list 101 permit udp any eq bootpc any
CiscoRtr(config)#
access-list 101 permit udp any eq bootps any
CiscoRtr(config)#
end
CiscoRtr#
8.
Double-check that the access list exists and is correct. (A nonexistent or incorrect access list can
lock up your router.)
CiscoRtr#
show ip access-lists
Extended IP access list 101
permit udp any any eq bootpc
permit udp any any eq bootps
permit udp any eq bootpc any
permit udp any eq bootps any
9.
Start packet debugging with the access list. (Omitting the access list can lock up your router.)
CiscoRtr#
debug ip packet 101 detail
10.
Stop debugging.
CiscoRtr#
undebug all
11.
View results in the log.
CiscoRtr#
show log
Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)
Console logging: disabled
Monitor logging: level debugging, 0 messages logged
Buffer logging: level debugging, 16 messages logged
Trap logging: level informational, 0 message lines logged
Log Buffer (4096 bytes):
*Mar 16 18:00:10.485: IP: s=0.0.0.0 (Ethernet0), d=255.255.255.255, len 328, rcvd 2
*Mar 16 18:00:10.485: UDP src=68, dst=67
*Mar 16 18:00:10.485: IP: s=10.1.1.1 (local), d=10.1.2.2 (Ethernet1), len 328, sending
*Mar 16 18:00:10.485: UDP src=67, dst=67
*Mar 16 18:00:10.492: IP: s=10.1.2.2 (Ethernet1), d=10.1.1.1, len 328, rcvd 4
*Mar 16 18:00:10.492: UDP src=67, dst=67
*Mar 16 18:00:10.492: IP: s=10.1.1.1 (local), d=10.1.1.10 (Ethernet0), len 328,
sending
*Mar 16 18:00:10.492: UDP src=67, dst=68
*Mar 16 18:00:10.510: IP: s=0.0.0.0 (Ethernet0), d=255.255.255.255, len 328, rcvd 2
*Mar 16 18:00:10.510: UDP src=68, dst=67
*Mar 16 18:00:10.510: IP: s=10.1.1.1 (local), d=10.1.2.2 (Ethernet1), len 328, sending
*Mar 16 18:00:10.510: UDP src=67, dst=67
*Mar 16 18:00:10.530: IP: s=10.1.2.2 (Ethernet1), d=10.1.1.1, len 328, rcvd 4
*Mar 16 18:00:10.530: UDP src=67, dst=67
*Mar 16 18:00:10.530: IP: s=10.1.1.1 (local), d=10.1.1.10 (Ethernet0), len 328,
sending
*Mar 16 18:00:10.530: UDP src=67, dst=68
