Downloads |
Table Of Contents
Restrictions for IP Traffic Export
Information About IP Traffic Export
IP Traffic Export Profiles Overview
Displaying IP Traffic Export Configuration Data
Configuration Examples for IP Traffic Export
Exporting IP Traffic Configuration: Example
debug ip traffic-export events
IP Traffic Export
The IP Traffic Export feature allows users to configure their router to export IP packets that are received on multiple, simultaneous WAN or LAN interfaces. The unaltered IP packets are exported on a single LAN or VLAN interface, thereby, easing deployment of protocol analyzers and monitoring devices.
12.3(4)T
This feature was introduced.
12.2(25)S
This feature was integrated into Cisco IOS Release 12.2(25)S.
Feature History for IP Traffic Export
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Restrictions for IP Traffic Export
•
•
Restrictions for IP Traffic Export
Platform Restriction
IP traffic export is intended only for software switching platforms; distributed architectures are not supported.
IP Packet Forwarding Performance Impact
When IP traffic export is enabled, a delay is incurred on the outbound interface when packets are captured and transmitted across the interface. Performance delays increase with the increased number of interfaces that are monitored and the increased number of destination hosts.
Exported Traffic Limitation
•
•
Information About IP Traffic Export
To use the IP traffic export, you should understand the following concept:
•
Benefits of IP Traffic Export
Simplified IDS Deployment
Without the ability to export IP traffic, the Intrusion Detection System (IDS) probe must be inline with the network device to monitor traffic flow. IP traffic export eliminates the probe placement limitation, allowing users to place an IDS probe in any location within their network or direct all exported traffic to a VLAN that is dedicated for network monitoring. Allowing users to choose the optimal location of their IDS probe reduces processing burdens.
Also, because packet processing that was once performed on the network device can now be performed away from the network device, the need to enable IDS with the Cisco IOS software can be elimintaed.
IP Traffic Export Functionality Benefits
Users can configure their router to perform the following tasks:
•
•
•
How to Use IP Traffic Export
This section contains the following procedures:
•
•
Configuring IP Traffic Export
Use this task to configure IP traffic export profiles, which enable IP traffic to be exported on an ingress interface and allow you to specify profile attributes, such as the outgoing interface for exporting traffic.
Note
IP Traffic Export Profiles Overview
All packet export configurations are specified via IP traffic export profiles, which consist of IP-traffic-export-related command-line interfaces (CLIs) that control various attributes for both incoming and outgoing exported IP traffic. You can configure a router with multiple IP traffic export profiles. (Each profile must have a different name.) You can apply different profiles on different interfaces.
The two different IP traffic export profiles are as follows:
•
•
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
DETAILED STEPS
Troubleshooting Tips
Creating an IP Traffic Export Profile
The interface and mac-address commands are required to successfully create a profile. If these commands are not issued, you will receive the following profile incomplete message if the show running config command is issued:
ip traffic-export profile newone! No outgoing interface configured! No destination mac-address configuredApplying an IP Traffic Export Profile to an interface
The following system logging messages should appear immediately after you activate and deactivate a profile from an interface (via the ip traffic-export apply profile command):
•
%RITE-5-ACTIVATE: Activated IP traffic export on interface FastEthernet 0/0.•
%RITE-5-DEACTIVATE: Deactivated IP traffic export on interface FastEthernet 0/0.If you attempt to apply an incomplete profile to an interface, you will receive the following message:
Router(config-if)# ip traffic-export apply newoneRITE: profile newone has missing outgoing interfaceWhat to Do Next
After you have configured a profile and enabled the profile on an ingress interface, you can monitor IP traffic exporting events and verify your profile configurations. To complete these steps, refer to the following task "Displaying IP Traffic Export Configuration Data."
Displaying IP Traffic Export Configuration Data
This task allows you to verify IP traffic export parameters such as the monitored ingress interface, which is where the IP traffic is exported, and outgoing and incoming IP packet information, such as configured ACLs. You can also use this task to monitor packets that are captured and then transmitted across an interface to a destination host. Use this optional task to help you troubleshoot any problems with your exported IP traffic configurations.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
Examples
The following sample output from the show ip traffic-export command is for the profile "one." This example is for a single, configured interface. If multiple interfaces are configured, the information shown below is displayed for each interface.
Router# show ip traffic-exportRouter IP Traffic Export Parameters
Monitored Interface FastEthernet0/0
Export Interface FastEthernet0/1
Destination MAC address 0030.7131.abfc
bi-directional traffic export is off
Input IP Traffic Export Information Packets/Bytes Exported 0/0
Packets Dropped 0
Sampling Rate one-in-every 1 packets
No Access List configuredProfile one is ActiveConfiguration Examples for IP Traffic Export
This section includes the following configuration example:
•
Exporting IP Traffic Configuration: Example
Figure 1 and the following sample output from the show running-config command illustrate how to configure Router 2 to export the incoming traffic from Router 1 to IDS:
Router2# show running-configBuilding configuration...Current configuration :2349 bytes! Last configuration change at 20:35:39 UTC Wed Oct 8 2003! NVRAM config last updated at 20:35:39 UTC Wed Oct 8 2003!version 12.3service timestamps debug uptimeservice timestamps log uptimeno service password-encryptionservice internalservice udp-small-servers!hostname rite-3745!boot system flash:c3745-js-mz.123-1.8.PI2dno logging consoleenable password lab!no aaa new-modelip subnet-zero!no ip domain lookup!ip cef!ip traffic-export profile my_riteinterface FastEthernet1/0mac-address 6666.6666.3333!interface FastEthernet0/0ip address 10.0.0.94 255.255.255.0duplex autospeed auto!interface FastEthernet0/1ip address 10.1.1.2 255.255.255.0duplex autospeed autoip traffic-export apply my_rite!interface FastEthernet1/0ip address 10.1.3.2 255.255.255.0no ip redirectsno cdp enable!interface FastEthernet1/1ip address 10.1.2.2 255.255.255.0duplex autospeed auto!router ospf 100log-adjacency-changesnetwork 10.1.0.0 0.0.255.255 area 0!ip http serverip classless!snmp-server engineID local 0000000902000004C1C59140snmp-server community public ROsnmp-server enable traps tty!control-plane!dial-peer cor custom!gateway!line con 0exec-timeout 0 0stopbits 1line aux 0line vty 0 4password lablogin!ntp clock-period 17175608ntp server 10.0.0.2!endAdditional References
The following sections provide references related to IP Traffic Export.
Related Documents
Standards
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
—
MIBs
RFCs
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
—
Technical Assistance
Command Reference
This section documents new commands.
•
bidirectional
To enable incoming and outgoing IP traffic to be exported across a monitored interface, use the bidirectional command in router IP traffic export (RITE) configuration mode. To return to the default functionality, use the no form of this command.
bidirectional
no bidirectional
Syntax Description
This command has no arguments or keywords.
Defaults
If this command is not enabled, only incoming traffic is exported.
Command Modes
RITE configuration
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
Usage Guidelines
By default, only incoming IP traffic is exported. If you choose to export outgoing IP traffic, you must issue both the bidirectional command, which enables outgoing traffic to be exported, and the outgoing command, which specifies how the outgoing traffic will be filtered.
The ip traffic-export profile command allows you to begin a profile that can be configured to export IP packets as they arrive or leave a selected router ingress interface. A designated egress interface exports the captured IP packets out of the router. Thus, the router can export unaltered IP packets to a directly connected device.
Examples
The following example shows how to export both incoming and outgoing IP traffic on the FastEthernet interface:
Router(config)# ip traffic-export profile johndoeRouter(config-rite)# interface FastEthernet1/0.1Router(config-rite)# bidirectionalRouter(config-rite)# incoming access-list 101Router(config-rite)# outgoing access-list 101Router(config-rite)# mac-address 6666.6666.3333Related Commands
debug ip traffic-export events
To enable debugging messages for exported IP packet events, use the debug ip traffic-export command in privileged EXEC mode. To disable debugging messages, use the no form of this command.
debug ip traffic-export events
no debug ip traffic-export events
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
Examples
The following is sample output from the debug ip traffic-export events command:
Router# debug ip traffic-export eventsRITE:exported input packet # 547RITE:exported input packet # 548RITE:exported input packet # 549RITE:exported input packet # 550RITE:exported input packet # 551RITE:exported input packet # 552RITE:exported input packet # 553RITE:exported input packet # 554RITE:exported input packet # 555RITE:exported input packet # 556RITE:exported input packet # 557RITE:exported input packet # 558RITE:exported input packet # 559RITE:exported input packet # 560RITE:exported input packet # 561RITE:exported input packet # 562Related Commands
ip traffic-export profile
Creates or edits an IP traffic export profile and enables the profile on an ingress interface.
incoming
To configure filtering for incoming IP traffic, use the incoming command in router IP traffic export (RITE) configuration mode. To disable filtering for incoming traffic, use the no form of this command.
incoming {access-list {standard | extended | named} | sample one-in-every packet-number}
no incoming {access-list {standard | extended | named} | sample one-in-every packet-number}
Syntax Description
Defaults
If this command is not enabled, all incoming IP traffic will be filtered via sampling.
Command Modes
RITE configuration
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
Usage Guidelines
When configuring a network device for exporting IP traffic, you can issue the incoming command to filter unwanted traffic via the following methods:
•
•
Examples
The following example shows how to configure the profile "corp1," which will send captured IP traffic to host "00a.8aab.90a0" at the interface "FastEthernet 0/1." This profile is also configured to export one in every 50 packets and to allow incoming traffic only from the ACL "ham_ACL."
Router(config)# ip traffic-export profile corp1Router(config-rite)# interface FastEthernet 0/1Router(config-rite)# bidirectionalRouter(config-rite)# mac-address 00a.8aab.90a0Router(config-rite)# outgoing sample one-in-every 50Router(config-rite)# incoming access-list ham_aclRouter(config-rite)# exitRouter(config)# interface FastEthernet 0/0Router(config-if)# ip traffic-export apply corp1Related Commands
ip traffic-export profile
Creates or edits an IP traffic export profile and enables the profile on an ingress interface.
outgoing
Configures filtering for outgoing export traffic.
interface (RITE)
To specify the outgoing interface for exporting traffic, use the interface command in router IP traffic export (RITE) configuration mode. To disable an interface, use the no form of this command.
interface interface-name
no interface interface-name
Syntax Description
Defaults
If this command is not enabled, the exported IP traffic profile does not recognize an interface in which to send captured IP traffic.
Command Modes
RITE configuration
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
Usage Guidelines
After you configure an IP traffic export profile via the ip traffic-export profile global configuration command, you should issue the interface command; otherwise, the profile will be unable to export the captured IP packets. If you do not specify the interface command, you will receive a warning, which states that the profile is incomplete, when you attempt to apply the profile to an interface via the ip traffic-export apply profile interface configuration command.
Note
Examples
The following example shows how to configure the profile "corp1," which will send captured IP traffic to host "00a.8aab.90a0" at the interface "FastEthernet 0/1." This profile is also configured to export one in every 50 packets and to allow incoming traffic only from the access control list ACL "ham_ACL."
Router(config)# ip traffic-export profile corp1Router(config-rite)# interface FastEthernet 0/1Router(config-rite)# bidirectionalRouter(config-rite)# mac-address 00a.8aab.90a0Router(config-rite)# outgoing sample one-in-every 50Router(config-rite)# incoming access-list ham_aclRouter(config-rite)# exitRouter(config)# interface FastEthernet 0/0Router(config-if)# ip traffic-export apply corp1Related Commands
ip traffic-export apply
To apply an IP traffic export profile to a specific interface, use the ip traffic-export apply profile command in interface configuration mode. To remove an IP traffic export profile from an interface, use the no form of this command.
ip traffic-export apply profile-name
no ip traffic-export apply profile-name
Syntax Description
profile-name
Name of the profile that is to be applied to a specified interface.
The profile-name argument must match a name that was specified via the ip traffic-export profile command.
Defaults
If this command is not issued, a sucessfully configured profile is not active.
Command Modes
Interface configuration
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
Usage Guidelines
After you have configured at least one profile, you should use the ip traffic-export apply profile command to activate an IP traffic export on the specified ingress interface.
Examples
The following example shows how to apply the profile "corp1" to interface Fast Ethernet 0/0:
Router(config)# ip traffic-export profile corp1Router(config-rite)# interface FastEthernet 0/1Router(config-rite)# bidirectionalRouter(config-rite)# mac-address 00a.8aab.90a0Router(config-rite)# outgoing sample one-in-every 50Router(config-rite)# incoming access-list spam_aclRouter(config-rite)# exitRouter(config)# interface FastEthernet 0/0Router(config-if)# ip traffic-export apply corp1After the profile is activated on the interface, a logging message such as the following will appear:
%RITE-5-ACTIVATE: Activated IP traffic export on interface FastEthernet 0/0.After the profile is removed from the interface, a logging message such as the following will appear:
%RITE-5-DEACTIVATE: Deactivated IP traffic export on interface FastEthernet 0/0.If you attempt to apply an incomplete profile to an interface, you will receive the following message:
Router(config-if)# ip traffic-export apply newoneRITE: profile newone has missing outgoing interfaceRelated Commands
ip traffic-export profile
Creates or edits an IP traffic export profile and enables the profile on an ingress interface.
ip traffic-export profile
To create or edit an IP traffic export profile and enable the profile on an ingress interface, use the ip traffic-export profile command in global configuration mode. To remove an IP traffic export profile from your router configuration, use the no form of this command.
ip traffic-export profile profile-name
no ip traffic-export profile profile-name
Syntax Description
Defaults
A profile does not exist.
Command Modes
Global configuration
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
Usage Guidelines
The ip traffic-export profile command allows you to begin a profile that can be configured to export IP packets as they arrive on or leave from a selected router ingress interface. A designated egress interface exports the captured IP packets out of the router. Thus, the router can export unaltered IP packets to a directly connected device.
IP Traffic Export Profiles
All exported IP traffic configurations are specified via profiles, which consist of RITE-related command-line interfaces (CLIs) that control various attributes of both incoming and outgoing IP traffic. You can configure a router with multiple profiles. (Each profile must have a different name.) You can apply different profiles on different interfaces.
The two profiles that you should configure are as follows:
•
•
The interface and mac-address commands are required to successfully create a profile. If these commands are not issued, the user will receive a profile incomplete messages such as the following:
ip traffic-export profile newone! No outgoing interface configured! No destination mac-address configuredAfter you configure your profiles, you can apply (which will activate) the profile to an interface via the ip traffic-export apply profile command.
Examples
The following example shows how to configure the profile "corp1," which will send captured IP traffic to host "00a.8aab.90a0" at the interface "FastEthernet 0/1." This profile is also configured to export one in every 50 packets and to allow incoming traffic only from the access control list (ACL) "ham_ACL."
Router(config)# ip traffic-export profile corp1Router(config-rite)# interface FastEthernet 0/1Router(config-rite)# bidirectionalRouter(config-rite)# mac-address 00a.8aab.90a0Router(config-rite)# outgoing sample one-in-every 50Router(config-rite)# incoming access-list ham_aclRouter(config-rite)# exitRouter(config)# interface FastEthernet 0/0Router(config-if)# ip traffic-export apply corp1Related Commands
mac-address (RITE)
To specify the Ethernet address of the destination host, use the mac-address command in router IP traffic export (RITE) configuration mode. To change the MAC address of the destination host, use the no form of this command.
mac-address H.H.H
no mac-address H.H.H
Syntax Description
Defaults
A destination host is not known.
Command Modes
RITE configuration
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
Usage Guidelines
The mac-address command, which is used to specify the destination host that is receiving the exported traffic, is part of suite of RITE configuration mode commands that are used to control various attributes for both incoming and outgoing IP traffic export.
The ip traffic-export profile command allows you to begin a profile that can be configured to export IP packets as they arrive or leave a selected router ingress interface. A designated egress interface exports the captured IP packets out of the router. Thus, the router can export unaltered IP packets to a directly connected device.
Examples
The following example shows how to configure the profile "corp1," which will send captured IP traffic to host "00a.8aab.90a0" at the interface "FastEthernet 0/1." This profile is also configured to export one in every 50 packets and to allow incoming traffic only from the access control lists (ACL) "ham_ACL."
Router(config)# ip traffic-export profile corp1Router(config-rite)# interface FastEthernet 0/1Router(config-rite)# bidirectionalRouter(config-rite)# mac-address 00a.8aab.90a0Router(config-rite)# outgoing sample one-in-every 50Router(config-rite)# incoming access-list ham_aclRouter(config-rite)# exitRouter(config)# interface FastEthernet 0/0Router(config-if)# ip traffic-export apply corp1Related Commands
ip traffic-export profile
Creates or edits an IP traffic export profile and enables the profile on an ingress interface.
outgoing
To configure filtering for outgoing export traffic, use the outgoing command in router IP traffic export (RITE) configuration mode. To disable filtering for outgoing traffic, use the no form of this command.
outgoing {access-list {standard | extended | named} | sample one-in-every packet-number}
no outgoing {access-list {standard | extended | named} | sample one-in-every packet-number}
Syntax Description
Defaults
If this command is not enabled, outgoing IP traffic is not exported.
Command Modes
RITE configuration
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
Usage Guidelines
When configuring a network device for IP traffic export, you can issue the outgoing command to filter unwanted outgoing traffic via the following methods:
•
•
Note
Examples
The following example shows how to configure the profile "corp1," which will send captured IP traffic to host "00a.8aab.90a0" at the interface "FastEthernet 0/1." This profile is also configured to export one in every 50 packets and to allow incoming traffic only from the ACL "ham_ACL."
Router(config)# ip traffic-export profile corp1Router(config-rite)# interface FastEthernet 0/1Router(config-rite)# bidirectionalRouter(config-rite)# mac-address 00a.8aab.90a0Router(config-rite)# outgoing sample one-in-every 50Router(config-rite)# incoming access-list ham_aclRouter(config-rite)# exitRouter(config)# interface FastEthernet 0/0Router(config-if)# ip traffic-export apply corp1Related Commands
show ip traffic-export
To display information related to router IP traffic export (RITE), use the show ip traffic-export command in privileged EXEC mode.
show ip traffic-export [interface interface-name | profile profile-name]
Syntax Description
Defaults
If this command is enabled, all data (both interface- and profile-related data) is shown.
Command Modes
Privileged EXEC
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
Examples
The following sample output from the show ip traffic-export command is for the profile "one." This example is for a single configured interface. If multiple interfaces are configured, the information shown below is displayed for each interface.
Router# show ip traffic-exportRouter IP Traffic Export Parameters
Monitored Interface FastEthernet0/0
Export Interface FastEthernet0/1
Destination MAC address 0030.7131.abfc
bi-directional traffic export is off
Input IP Traffic Export Information Packets/Bytes Exported 0/0
Packets Dropped 0
Sampling Rate one-in-every 1 packets
No Access List configuredProfile one is ActiveTable 1 describes the significant fields shown in the display.
Related Commands
Copyright © 2004 Cisco Systems, Inc. All rights reserved.
