Cart
IP Traffic Export is a lot like SPAN for switches, except it is for routers. A copy of traffic received on configured interfaces is exported out another interface while the original flow is not impacted.
This diagram sums what happens and below we take a look at the configuration.
R2’s configuration is pretty simple:
ip traffic-export profile EXPORT interface FastEthernet3/0 bidirectional incoming access-list 100 outgoing access-list 101 mac-address 001d.6094.d09d incoming sample one-in-every 5 outgoing sample one-in-every 5 ! interface FastEthernet1/0 ip traffic-export apply EXPORT ! access-list 100 permit tcp any any eq telnet access-list 101 permit tcp any eq telnet any
The above configuration shows most of the options you can configures. R2 exports traffic passing through interface FastEthernet1/0 in both directions as long as it matches ACL 100 on ingress or ACL 101 on egress. In addition, only 1 out of every 5 packets is actually exported. When the packets are exported, the destination MAC address is modified to that of the analyzer. The MAC address and interface are the only required parameters in the profile.
In this example our analyzer is a PC with Wireshark running. Below is a screenshot of the capture file. You can see that since we only sample 20% of the packets, Wireshark interprets the stream as having lost segments. Also notice the destination MAC address has been modified according to the configuration.
This feature is currently listed on the v4 Routing and Switching blueprint. Not too tough, so get familiar with commands and continue studying!
–
Bryan Bartik
CCIE #23707 (R&S, SP)
Tags: CCIE, CCIE Routing and Switching, router ip traffic export
Having trouble finding this in the Doccd, any clue on its location?
http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_rawip.html
It is in the 12.4T documentation under the Feature Guides.
Cisco IOS Security Configuration Guide: Securing User Services, Release 12.4T
-> User Security Configuration
-> IP Traffic Export
Looks easy enough, plus very handy for the real world to troubleshoot a specific IP flow passing through a router. Do you have to dedicate the port exporting solely to this use when configuring this option? or can the interface forward traffic while exporting (if there is enough bandwidth of course)
The logic is to capture live traffic so yes you can use the router in a normal fashion.
You can also use a capture option of RITE to actually create a local capture file, then copy that off to your PC to open with Wireshark. I’ve done that for troubleshooting voice issues with a remote router, very handy indeed.
http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_rawip.html#wp1051438