ru.cisco

 
 - RU.CISCO ---------------------------------------------------------------------
 From : Irakli Natsvlishvili                 2:5020/400     19 Jan 2003  04:37:14
 To : All
 Subject : NBAR & protocol filtering
 -------------------------------------------------------------------------------- 
 

 Hello, All!
 
 Вот выдержка из sh pol int
 
 FastEthernet0/1
 
   Service-policy input: Deny
 
     Class-map: Deny (match-any)
       807 packets, 49976 bytes
       5 minute offered rate 0 bps, drop rate 0 bps
       Match: protocol napster
         168 packets, 10362 bytes
         5 minute rate 0 bps
       Match: protocol custom-02
         0 packets, 0 bytes
         5 minute rate 0 bps
       Match: protocol fasttrack
         611 packets, 37896 bytes
         5 minute rate 0 bps
       Match: protocol gnutella
         5 packets, 306 bytes
         5 minute rate 0 bps
       Match: protocol http url "*default.ida*"
         1 packets, 60 bytes
         5 minute rate 0 bps
       Match: protocol http url "*cmd.exe*"
         21 packets, 1292 bytes
         5 minute rate 0 bps
       Match: protocol http url "*root.exe*"
         1 packets, 60 bytes
         5 minute rate 0 bps
       Match: protocol http url "*readme.eml*"
         0 packets, 0 bytes
         5 minute rate 0 bps
       Match: protocol http url "*readme.exe*"
         0 packets, 0 bytes
         5 minute rate 0 bps
       Match: protocol http url "*admin.dll*"
         0 packets, 0 bytes
         5 minute rate 0 bps
      police:
          cir 1000000 bps, bc 31250 bytes, be 31250 bytes
        conformed 807 packets, 49976 bytes; actions:
          drop
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps, violate 0 bps
 
 Задача следующая - идентифицировать хосты, с которых пошли пакеты на которых
 сработал триггер. Количество хостов - где-то 80, все они подключены к 4-м
 2924, т.е. запустить сниффер не получится. Вопрос - есть ли возможность
 сделать идентификацию средствами самой кошки?
 
 Второй вопрос. По выводу информации sh int
 
 FastEthernet0/1 is up, line protocol is up
   Hardware is AmdFE, address is 0002.4b62.28c1 (bia 0002.4b62.28c1)
   Description: Local LAN
   Internet address is 192.168.20.1/24
   MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
      reliability 255/255, txload 1/255, rxload 1/255
   Encapsulation ARPA, loopback not set
   Keepalive set (10 sec)
   Full-duplex, 100Mb/s, 100BaseTX/FX
   ARP type: ARPA, ARP Timeout 04:00:00
   Last input 00:00:01, output 00:00:01, output hang never
   Last clearing of "show interface" counters never
 
   Input queue: 0/75/75446/0 (size/max/drops/flushes); Total output drops: 0
 
 drops отражет те пакеты, которые отборсились в результате полиси, или что-то
 еще?
 Для инфо:
 
 IOS (tm) C2600 Software (C2600-IK9O3S-M), Version 12.2(11)T2,  RELEASE
 SOFTWARE (fc1)
 TAC Support: http://www.cisco.com/tac
 Copyright (c) 1986-2002 by cisco Systems, Inc.
 Compiled Sun 13-Oct-02 22:45 by ccai
 Image text-base: 0x8000809C, data-base: 0x8181DB20
 
 ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1)
 
 Cisco2621 uptime is 1 week, 4 days, 2 hours, 54 minutes
 System returned to ROM by reload at 13:30:25 PST Tue Jan 7 2003
 System restarted at 13:36:20 PST Tue Jan 7 2003
 System image file is "flash:c2600-ik9o3s-mz.122-11.T2.bin"
 
 cisco 2621 (MPC860) processor (revision 0x102) with 59392K/6144K bytes of
 memory.
 Processor board ID JAB04230ASE (2216854019)
 M860 processor: part number 0, mask 49
 Bridging software.
 X.25 software, Version 3.0.0.
 2 FastEthernet/IEEE 802.3 interface(s)
 1 Serial network interface(s)
 32K bytes of non-volatile configuration memory.
 16384K bytes of processor board System flash (Read/Write)
 
 Configuration register is 0x2102
 
 I.N.
 
 --- ifmail v.2.15dev5
  * Origin: Demos online service (2:5020/400)
 
 

Вернуться к списку тем, сортированных по: возрастание даты  уменьшение даты  тема  автор 

Тема:    Автор:    Дата:    NBAR & protocol filtering   Irakli Natsvlishvili   19 Jan 2003 04:37:14   Re: NBAR & protocol filtering   Andrey Tarasov   19 Jan 2003 04:57:40