E3000 -- No OUTgoing traffic logged

I noticed that no OUTgoing traffic was being logged by my E3000. I tried WW and even sent some raw logs to the dev and he confirmed the same.
During a recent online chat with a Cisco|Linksys rep., I was told that the E3000 does NOT support logging of OUTgoing traffic at this time. He then mentioned that it might be available in a future FW update. My FW version is: 1.0.01 build 6 Apr. 15, 2010.
The reson I mention this is that I have been reading messages from users who have been logging OUTgoing traffic with their E1000 and E2000 routers. If this is the case, then is the E3000's firmware that different?
Flashfox

Working fine here... same firmware version, build 6.
Uploaded with ImageShack.us

Similar Messages

Outgoing network traffic log ?

Hi
Is there a way to save a log of the headers of all outgoing traffic from all apps? (e.g. app, time, destination IP)
I suspect some of my apps (or extensions of them) are phoning home and since I these app need to access the web for their main purpose (e.g. FireFox) I can't just block them entirely.
Inspecting an outgoing traffic log (preferably containing reverse IP lookups) would allow me to set custom rules with Little Snitch.
Thanks for any advice

You can use tcpdump to view the packets. For more detail, look at Wireshark (previously known as Ethereal).
At a bare minimum, you will likely want something like:
sudo tcpdump -tttt -vvv
Add in the -i en1 if you are using the Airport card. See man tcpdump for all the details. Wireshark will provide even more details and ways of filtering the information.
Hope this helps

Time Capsule Traffic Logs

Is there a way to on the new Time Capsule (1 TB) to view the incoming and outgoing traffic log(s), preferably by MAC address or IP address?

No, you can't get the kind of detail it sounds like you're looking for. You'll only be able to get information for each interface type, i.e., traffic over the WAN, the ethernet, or the wireless. It's not as sophisticated as more expensive managed switches that would allow monitoring by port (or client).
That said, you can get some information out by turning on SNMP in the AirPort Utility. It's in the "Advanced" settings. I'd turn off "Allow SNMP over WAN", though. You can see what's available if you run this command from the Terminal:
snmpwalk -c public -v 2c nnn.nnn.nn.nn
where nnn.nnn.nn.nn is the IP address of your Time Capsule. That will allow you to see what you can monitor. It can be a little overwhelming, though. There's an app called AirPort Flow that's should work, though I've never used it. There's something called Lithium, that looks like it might work, too.
If you're handy with compiling and installing command-line software, MRTG works (it's what I'm using). Cacti is another possibility, though I don't know much about it. Those two will take some serious time to set up, they're not really even close to "plug and play".
charlie

Need Help to create access-list based on traffic logs

Hello,
We didn't have any Firewall in our network, we recently implemented Cisco ASA (Context) firewall in our network with any any permit rule .
Our intension is to collect the source, destination, protocol & ports based on the traffic logs and then implement the access-lists , once we confirmed all the rule will added to the firewall we want remove any any permit rule .
I need some suggestion regarding this how we can proceed on this plan, any suggestions appreciated
Rajkumar

Hi Rajkumar,
That is not the ideal way of doing... this will lead to a provisioning an unauthorized person to access for something he is not authorized to.
How many users do you have in your network? Try to categorize users based on their present authorization level of access.... say Team A users need to access everything... then you need to group them and provide full access..... Team B users need to be provided with only restricted access.... then group them and provide restricted access....
If your case is something like this.... all users need unrestricted intranet access and certain users alone requires internet acceess... then you can define rules accordingly....
Regards
Karthik
Regards
Karthik

RV016 (V3) tcp and udp outgoing traffic issue

Hi everyone.
I've got a CISCO RV016 connected to a tooway SAT modem and need to reach another router connected in DSL
I need to make a TCP connection on port 8080 with my audio codec to reach the other side, and get audio.
I do not feel comfortable with all the security process, firewall, forwarding port and so on ...
What do I need to do to make the RV016 let the TCP out ?
do I need to create rules ? do I need to modify the firewall factory settings ?
does UDP outgoing traffic need some rules too ?
Thank's for your help.
Nicolas.
System Information
Serial Number : NKS16450006
Firmware Version : v4.2.1.02 (Jan 18 2012 14:10:55)
PID VID : RV016 V03
Firmware MD5 Checksum : a9817f2dbdcbd6a5c109eaa21b1c3545
LAN Working Mode : Gateway

Hi Nicolas, thank you for using our forum, my name is Johnnatan I am part of the Small business Support community. If you want other method instead forwarding I could advise you One-to-one NAT. I will share a document to you regarding this configuration.
http://www6.nohold.net/CiscoSB/Loginr.aspx?login=1&pid=2&app=search&vw=1&articleid=544
I hope you find this answer useful
“Please rate useful posts so other users can benefit from it”
Greetings,
Johnnatan Rodriguez Miranda.
Cisco Network Support Engineer.

ASA5505 how to record the traffic log

Hello, everyone,
I want to analysis the log from asa5505,
I have configured the device to send the log to a syslog server.
but I found the log seems like event log, it's format like below :
6|Nov 11 2010|18:07:33|302014|192.168.2.22|192.168.1.2|Teardown TCP connection 986 for outside:218.30.82.201/80 to inside:192.168.1.2/1764 duration 0:10:01 bytes 619 FIN Timeout
I want to obtain the traffic log, it may contains each connection record information, including send bytes and receive bytes, URL and so on...
but I can't find out how to setup the device to let the asa5505 record the traffic log,
someone can give some tips, thanks in advanced.

Hi,
You need to enable the Netflow protocol.
Here are two documents related to Netflow for Cisco ASA:
https://supportforums.cisco.com/docs/DOC-6114
https://supportforums.cisco.com/docs/DOC-6113
Best regards,
Giorgos

Full Traffic Logging

I'm using too much bandwidth, and hitting my ISP caps, which is expensive! I need to do full traffic logging to see exactly where the problem lies - I'd like to know IP address vs data per hour + actual traffic throughput in bytes/sec, ideally.
I've read earlier posts here that suggest setting logging onto the Airport Express (mine is on Version 6.3) to level 8 - presumably traffic detail. My Airport only goes to level 7 - Debug. Is there an upgrade to the software or something else that I can do to get a higher level of logging?
Alternatively, is there a way to turn on logging on all my Macs and then centralise this? I've got four or five machines on my wi-fi network (I'm not sure if the iPhone counts, but it might be responsible for some of this traffic problem)?
How do I turn on IP logging

To log all the internet traffic on your local network you need to have router that supports that functionality. The only utilities I have found measures total in and out traffic using a utility called airport flow.
I have an airport base station but only use it as an access point my main router is a mini pc running router software called pfsense on which I have installed a utility called bandwidthd this graphs total traffic and per individual IP address.
bandwidthd is available for mac osx but you cant install it on our aiport base station you would have to install it in each individual mac.
http://mac.softpedia.com/get/Network-Admin/bandwidthd.shtml

Getting syslog from cisco 5585 how to segerate from traffic logs?

Support ,
I need some help, I want syslog from cisco asa 5585 to come to siem , but the networking guy says he can configure cisco asa 5585 to send both traffic and syslog together; there is no segerration; I don't want this to happen im just interested in getting the syslog events. In almost every firewall e.g juniper to send only traffic logs.
If its true what the networking guy says, its a very poor desgin where there is high coupling between processes;if they are dependent and one is needed to get the other what about if one thing fails?
I'm the sec guy; and I don't have the config guide about how cisco asa works at that level; i will appreciate if someone can verify or better suggest me a workaround if there exists to this issue.
Thanks.

Hi,
So you have been told that some other traffic would be also sent through the interface? That should not be the case. I dont know why the ASA would need to send any traffic to your server other than UDP/514 port traffic. If I remember correctly that is the UDP ports used.
If I would have to guess there might be a little missunderstanding between you. They might mean that they are already sending logs to some Syslos Server and the log level has been set so that the logs include all logs of connection forming through the ASA and therefore would send you very specific logs about the ASA.
The logging level set for logs that are sent to Syslog server applies to every target Syslog server. I dont think you can even specify different logging levels to different servers. But I might be mistaken.
But I am not sure what the situation is. Sounds a bit wierd.
We use a dedicated interface on ASAs to send logs to Syslog server. We might also use link for some remote management connections and monitoring.
- Jouni

Traffic logging on a Content Blade

Hello,
We need to create some statistics on usage of a couple of websites. The tools used to produce this are based on the traffic logs. Whenn we use the server logs we see only 1 client, the Content Switch...
I like to know whether it is possible to get this information from the Content switch. We need to be able to see who is doing what on the webserver.
The setup is a Cat 6513 with a CS blade. Behind this switch is a serverfarm.

you can use the http header insert function to insert the client ip address inside the http header when the CSM forwards clients to servers.
It is then up to you to retrieve this information on the server.
http://www.cisco.com/en/US/products/hw/switches/ps708/products_installation_and_configuration_guide_chapter09186a00802003ac.html#wp1047132
It is not recommended to try to turn on some logging on the CSM to get the list of connections.
You would kill the performance of the CSM.
If you don't want to get the info from the http header, then ask yourself why you only see the CSM address connecting to the servers.
Do you really need client nat ?
You should maybe change the design so client nat is not required and the CSM forwards client traffic unnated so the server can log exactly which client was connected.
Regards,
Gilles.

OUTGOING CALL LOG

HOW DO U FIND UR OUTGOING CALL LOG ON VERIZON.COM, IM TRYING TO LOOK AT MY HOME PHONE OUTGOING CALL LOG

I've been nagging Verizon on this one alot. If you have one of the international long distance plans, you get 300 or 500 minutes of international long distance, then any time over this allotment is billed by the minute. The problem is that you have NO WAY of knowing how many minutes you have used, until the bill comes at the end of the month.
I've had customer support say:
- You need to track the time yourself - we suggest a stop watch.
- I get several calls a month about this , but we don't have an answer.
- We are trying to resolve this issue.
- You don't need to know how many minutes you used. (They indirectly imply this)
- We can see how many minutes you used, but can only tell you to resolve a fraud alert issue regarding unusual long distance activity. (This bugs me as much as suggesting I use a stop watch)
- If you switch to the more expensive 500 minute plan, you won't have to worry as much.
Call assistant would be the logical place to put outgoing calls, with international plan minute totals, but what do I, a customer, know.
CM
Message Edited by ComposMentis on 05-18-2009 07:26 AM
Message Edited by ComposMentis on 05-18-2009 07:27 AM
Message Edited by ComposMentis on 05-18-2009 07:42 AM

Periodically disappears outgoing traffic. Iphone4. SIM card changed, update the firmware.

periodically disappears outgoing traffic. Iphone4. SIM card changed, update the firmware.

This wine automatic translation ... I can not make outgoing calls except emergency calls.

I need help blocking outgoing traffic.

I need to block all outgoing traffic on port 8008 to a specific IP address. I have been told by the guys at the genius bar that this can be done but I can't make it happen. This is imperative to my work. I am currently being blacklisted by my web host every ten minutes because something which can't be identified on our network is probing our web hosts IP using port 8008. I know this can be done on other wireless routers but I can't find how to do it on my 802.11n Extreme. There are several advantages to the extreme and I would like to continue to use it but I can't if I can't block that port.
Can someone please help me?

That's completely stupid. Why on earth does apple even make a router if they are not capable of keeping it up to par with other routers on the market. I admit it has several neat features but they are useless if I can't use it. Guess I'll have to use a cheapo Netgear router. They will at least allow me to block a port if I so desire.

Outgoing call log shows calls from my own number to the same number

Every so often, I pick up the phone to dial out and get a fast busy tone. I hang up, wait a few seconds, and try again, and I have dial tone and can dial out.
I have not noticed any pattern or timeframes when this occurs.
When looking at my online call log, I see calls at very random and arbitrary times of the day in the Outgoing column from my own number and TO the same number. ALWAYS after that there is an entry that the call went to voice mail. There is never an actual voice mail message, of course; I guess it hangs up before VM detects a valid message.
There appears to be an entry like this every single day, but, again, at very different times and with no discernible pattern.
Why is my own phone number trying to dial out to itself and at various times of day and night?

Having the same issue. Calls being made FROM my Maryland home landline TO a Virginia number.
I tried calling the number from my office phone, but it goes straight to an unoccupied voicemail.
When I first called about it, the Verizon representative also reassured me there was no charge for these calls, but that is not the issue. The issue is that someone or some machine has access to my home landline and it is making these calls. She was pretty insistent that it must be someone in my home, but much like others have stated, the records show that calls are made when no one is home, or when we are all home watching TV in the living room. We have one phone in the kitchen, so there are no secret calls being made. And certainly not 20+ times a month.
The first representative transferred me to another tech. At first, the new tech dismissed the idea that there could be cross-wiring (what the first tech suggested) because it's over the internet. There are no physical wires to cross.
The tech eventually ran a test and determined there was a "short bound in the wiring," so she said she was going to "reboot the ONC." I don't know what any of that means.
The test came back successful, and she was able to block the number (inbound and outbound).
I told both techs that this problem is not unique to my account; that there are several people on Verizon forums reporting the same issue.
She was not able to explain why, so we are no closer to figuring this out.
All I can recommend is calling Verizon tech support and having the number blocked. We'll see what happens with the next bill.
Also, if it's worth typing out, make sure you're reviewing your bills from Verizon. I've had to call at least five times in the 4.5 months about one thing or another.

ASDM Traffic Logs

I'm fairly new to ASDM so I apologize for this noob question. I need to see what is actually passing through a specific source IP and destination IP, my goal is to identify which specific ports I'm missing on an IP ruleset. My logging is setup to "Debugging" but I can't seem to see what ports are being dropped/allowed whenever I check the Log Buffer & Real-Time Log Viewer.Do I need to setup some sort of packet trace? Need help on setting up filters please.

Hi,
If you check my earlier messages you will see that I mentioned the Syslog ID 106023. In your above list its disabled so that is why the ASDM is not showing the logs. And if I can remember correctly you also have disabled some logs that show when a connection is built and torn down from the ASA. The mentioned log messages in my opinion are pretty important messages to record to Syslog server. They are great to have when a user reports a problem that might have begun several days ago or you are possibly trying to track and find a computer in your network that is causing spam and possibly blacklisting your public IPs and so on.
So you would have to enter this command
logging message 106023
Also all these disabled IDs are log messages that record TCP/UDP/ICMP connection forming and teardown
no logging message 302015
no logging message 302014
no logging message 302013
no logging message 302018
no logging message 302017
no logging message 302016
no logging message 302021
no logging message 302020
Basically it means you are not recording any connections that are formed through your firewall.
Also this Syslog ID is related to a situation when ASA blocks some traffic
no logging message 106100
- Jouni

Concentrator: User Traffic Logging

Hi,
is there a possibily to log the traffic generated by a VPN client user? Traffic means protocol, destination ip and port.
Something like netflow for users?
thx.
marco

Hi Waheed,
You can use Network Performance tools from Riverbed.
http://www.riverbed.com/products/
HTH

E3000 -- No OUTgoing traffic logged

Similar Messages

Maybe you are looking for