Problem with debug config

Question

cisco 2651XM router
IOS: c2600-adventerprisek9-mz.124-15.T9.bin
I have a mail-and-web server set at 192.168.0.6 connected to fa0/0 on my router and I want to monitor all traffic in and out of the server. The best debug config I've found so far for this is:
access-list 106 permit ip any host 192.168.0.6
access-list 106 permit ip host 192.168.0.6 any
no ip route-cache (on fa0/0)
debug ip packet 106
but this doesn't show mail traffic. I do see some activity in the form of outside ip's probing the server but when I send or receive mail I should see activity in the debug but there's nothing. Is there a better way to capture ALL traffic to and from this ip address? Thanks for any help.

Answer 1

Hi Tony.
That's correct - ip source tracker will never show you real time information.
A better solution to your current debug would be to re-enable CEF switching but then to configure an ACL that logs traffic to this particular host. Why this would be better is because your router will only be process switching the traffic to/from this host and not process switching ALL traffic. An example would be:
access-list 106 permit ip any host 192.168.0.6 log-input
access-list 106 permit ip any any
access-list 107 permit ip host 192.168.0.6 any log-input
access-list 107 permit ip any any
ip access-list log-update threshold 1
interface f0/0
ip route-cache cef
ip access-group 106 out
ip access-group 107 in
A more permanent solution could be the IP Export feature and then you can view your traffic on wireshark. I've not configured this myself.
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gt_rawip.html
Simon